Linux kernel IB/isert (full-feature-phase PDU byte_len validation): isert_recv_done() passes received PDUs to the

Impact

isert_recv_done() passes received PDUs to the opcode handlers without ever checking wc->byte_len, the count of bytes the HCA actually placed in the receive descriptor. isert_handle_iscsi_dataout() and isert_handle_scsi_cmd() then copy the initiator-declared data-segment length out of that fixed ISER_RX_SIZE descriptor, so an initiator that declares more than it sent over-reads the receive buffer. The immediate-data path is worse than a read: it aliases the descriptor via sg_set_buf() and hands it to the backend as the source of a SCSI WRITE, so kernel heap past the descriptor is written through to the backing store. Nothing upstream closes this - the target core bounds the inbound payload against MaxXmitDataSegmentLength, which is derived from a value the initiator declares verbatim, and isert never clamps it to its own descriptor size. For an operator, a host on the storage fabric can corrupt data at rest on a shared target and crash the node that serves it.

Who can reach it

An initiator that has completed login on the iSER/RDMA target - full feature phase - having declared a large TargetRecvDataSegmentLength and a FirstBurstLength that permits immediate or unsolicited data. Post-authentication, unlike CVE-2026-90413 in the login path of the same driver.

What to do

Move target nodes onto a stable kernel that validates wc->byte_len against the declared framing before the handlers copy. That is a drain and reboot per node. Until then treat the set of initiators permitted to log in to the target as the security boundary, and check backing-store integrity if you suspect an initiator has been abusing it. The record links the stable commits for backporting.

References

Related entries

• KVM arm64 vgic-its: restored ITS device table entry with oversized num_eventid_bits is not rejectedCVE-2026-64106 · Linux kernel KVM arm64 vgic-its (vgic_its_restore_dte num_eventid_bits validation)Critical
• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High