Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slab

Impact

login->req_buf is allocated at exactly MAX_KEY_VALUE_PAIRS (8192) bytes and the length check uses '>', so a payload of 8189-8192 bytes fills it completely with no room for a terminator. The buffer is then consumed as a C string: kstrdup(), strstr() and strlen_semi() have no length bound, and convert_null_to_semi() rewrites embedded NULs to ';', so parsing walks into adjacent slab memory. This is reachable by an unauthenticated initiator against a portal configured for CHAP - when authentication is not required the AuthMethod is rewritten to None and the CHAP path is never entered. A Linux host exporting iSCSI LUNs to a GPU fleet is therefore attackable by anything that can open a TCP session to the portal. The fix allocates one extra zeroed byte.

Who can reach it

Network, unauthenticated - anyone who can reach the iSCSI portal (typically the storage VLAN) on a target configured to require CHAP. Targets that do not require authentication do not reach the vulnerable path.

What to do

Update to a stable kernel with the linked commits and reboot the target hosts; on an active storage target that means failing over or scheduling downtime for the LUNs it serves. Until then, restrict portal reachability to the storage network and known initiator addresses. No fixed release numbers appear in the record.

References

Related entries

• Linux kernel nvmet: unvalidated transfer length and halen/dhlen cause heap out-of-bounds read in CHAP negotiateCVE-2026-90230 · Linux kernel nvmet (NVMe-oF target DH-HMAC-CHAP negotiate path)Critical
• Linux kernel IB/isert: login PDU declaring more data than received over-reads the 8KB login bufferCVE-2026-90413 · Linux kernel IB/isert (iSER login PDU DataSegmentLength validation)Critical
• Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to theCVE-2026-90414 · Linux kernel IB/isert (full-feature-phase PDU byte_len validation)Critical
• KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejectedCVE-2026-64106 · Linux kernel KVM arm64 vgic-its (vgic_its_restore_dte num_eventid_bits validation)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High