Linux kernel LIO iblock: missing PR handler checks let PERSISTENT RESERVE OUT NULL-deref the kernel

Impact

iblock_execute_pr_out() gated PRO_PREEMPT, PRO_PREEMPT_AND_ABORT and PRO_RELEASE on the presence of ops->pr_clear rather than on the hook each command actually calls, so a backing device that implements only part of the persistent-reservation op set lets an unimplemented function pointer be dereferenced as NULL. The result is an oops in the storage target's I/O path, which on a LIO export means the node serving the LUNs goes down and every initiator attached to it loses its block devices at once. For a GPU fleet that boots or checkpoints off iSCSI/FC LUNs from a shared target, that is a fleet-wide stall rather than a single-node incident. The kernel CNA rates this network-reachable with no privileges, consistent with the command arriving from any initiator allowed to talk to the target.

Who can reach it

Any SCSI initiator that can reach an exported LIO LUN over iSCSI, FC, SRP or iSER and send a PERSISTENT RESERVE OUT command. No host login on the target is needed; only whatever authentication the transport itself enforces.

What to do

Take the fixed stable kernel from the linked commits and reboot the storage target nodes; there is no module-reload path for an in-tree target fix that is safe while LUNs are exported. Until then, restrict which initiators may log in to the target (ACLs, transport-level auth, management-network isolation) so untrusted hosts cannot issue PR OUT commands. The kernel record names no fixed release number beyond the stable commits themselves.

References

Related entries

• Linux kernel iomap: ioend splitting draws from its own exhausted bio_set and deadlocks writebackCVE-2026-80720 · Linux kernel iomap writeback (iomap_split_ioend sharing iomap_ioend_bioset)High
• Linux kernel crypto/krb5: derived Kerberos keys left in freed slab memoryCVE-2026-80924 · Linux kernel crypto/krb5 (derived key buffers for RPCSEC_GSS)High
• Linux kernel ntb_transport: oversized transmit buffers leak skbs until the host runs out of memoryCVE-2026-80987 · Linux kernel NTB ntb_transport / ntb_netdev (oversized TX buffer skb leak)High
• OpenSSL 4.0: use-after-free in the X.509 extension cache crashes multi-threaded TLS peersCVE-2026-84783 · OpenSSL 4.0 X.509 extension cache (concurrent X509 use)High
• OpenSSL QUIC: unthrottled RETIRE_CONNECTION_ID backlog lets a peer force ~400MB of allocationCVE-2026-84784 · OpenSSL QUIC stack (NEW_CONNECTION_ID / RETIRE_CONNECTION_ID handling)High
• Linux kernel SUNRPC: gssx decode error paths NULL-deref and leak group_info on the NFS serverCVE-2026-89544 · Linux kernel nfsd/SUNRPC gssx option-array decoder (gss-proxy upcall)High