Linux kernel LIO target: unbounded iSCSI TransportID parse in PR OUT reads past the parameter buffer

Impact

The PERSISTENT RESERVE OUT parameter buffer is handed to the TransportID parser without a length, so an iSCSI name containing neither the ",i,0x" ISID separator nor a NUL terminator makes strstr() run off the end. When the parameter list spans more than one page the buffer is a multi-page vmap, so the over-read hits the trailing vmalloc guard page and oopses the storage node's kernel. A malformed separator at the very end of the descriptor also leaves the registration code dereferencing a pointer one past the descriptor as the ISID string. The record establishes an out-of-bounds read and a crash, not code execution. This matters on nodes that export block storage over LIO, and on virtualization hosts, because the description states it is reachable from a guest through vhost-scsi - a tenant VM taking down the host it shares.

Who can reach it

Any initiator that can send a PERSISTENT RESERVE OUT to a LUN exported through an iSCSI TPG, or a guest with a vhost-scsi device. Whether authentication is needed depends on your target configuration - without CHAP on the TPG this is reachable by anyone who can open the iSCSI port. Nodes that only consume iSCSI or Ceph storage are not affected; the flaw is in the target side.

What to do

Update to a stable kernel carrying the bounded TransportID parse; the record gives commits rather than released versions, so confirm the shipped build with your distribution. Drain and reboot each storage or virtualization host that runs LIO. If you cannot patch soon, restrict which initiators can reach the TPG (CHAP, initiator ACLs, management-network-only portals) and audit whether any guest is given a vhost-scsi device.

References

Related entries

• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: The sibling of theCVE-2026-72130 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request duringCVE-2026-74345 · Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation)Critical
• Linux kernel (drivers/nvme/host): An off-by-one in the Flexible Data Placement index check accepts a placement indexCVE-2026-74361 · Linux kernel (drivers/nvme/host)Critical