Linux kernel IB/isert: login PDU declaring more data than received over-reads the 8KB login buffer

Impact

isert never calls iscsi_target_check_login_request(), so nothing compares the DataSegmentLength an initiator declares in the login BHS against the byte count the HCA actually delivered. The login code then kmemdup_nul()s the declared length out of a fixed 8192-byte login->req_buf, reading past it by an attacker-chosen amount - reproducible under KASAN both in iscsi_target_locate_portal() for the first PDU and in iscsi_decode_text_input() for later ones. This happens before authentication, so any node on the RDMA fabric that can open an iSER login to the target reaches it. iSCSI over plain TCP is not exposed; the bug is specific to the RDMA path, which is exactly the path a datacenter uses for its fast storage network. Impact is kernel heap disclosure and target crash, which drops the fabric's storage clients with it.

Who can reach it

Any initiator that can reach the iSER/RDMA target portal - typically anyone on the InfiniBand or RoCE fabric. No authentication required; the flaw is in the pre-auth login path. Nodes not running an isert target are unaffected.

What to do

Upgrade to a stable kernel carrying the fix, which rejects a login PDU whose declared DataSegmentLength exceeds what was received in both isert_get_login_rx() and isert_login_recv_done(). Drain and reboot each target node. Interim mitigation is fabric-side: restrict which initiators can reach the target portal. Note that the rejected-PDU path leaves the login for the login timer to tear down, so a malformed PDU shows up as a login timeout rather than an immediate failure. CVE-2026-90414 is the matching post-login flaw in the same driver and needs the same kernel.

References

Related entries

• Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to theCVE-2026-90414 · Linux kernel IB/isert (full-feature-phase PDU byte_len validation)Critical
• KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejectedCVE-2026-64106 · Linux kernel KVM arm64 vgic-its (vgic_its_restore_dte num_eventid_bits validation)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High