Linux kernel libiscsi: target-supplied ITT in a Reject PDU completes an arbitrary task

Impact

An iSCSI target - or anything able to inject into the unauthenticated TCP session carrying iSCSI - controls the ITT copied into a Reject PDU, and iscsi_handle_reject() uses that value to look up a task with only an upper bound check against cmds_max. A never-used index yields a task with a NULL conn and a kernel oops (KASAN null-ptr-deref shown in the report); a returned task trips the WARN_ON_ONCE in iscsi_complete_task() and underflows the refcount. Worse than the crash: an in-flight SCSI command can be completed as successful with none of its buffer written, so a 1 MiB read returns 1048576 bytes of stale memory with no error. For GPU nodes that boot from or mount iSCSI LUNs - checkpoints, dataset volumes, root disks - that is silent data corruption on the storage path plus a host crash that takes every pod on the node with it.

Who can reach it

No local access needed and no authentication beyond what the iSCSI session itself provides: the attacker must be the iSCSI target the node is logged into, or be positioned on the storage network to inject into that TCP connection. Nodes with no iSCSI initiator configured are not exposed.

What to do

Pick up a stable kernel that carries the libiscsi ITT-validation fix (five stable commits are linked in the record; the advisory names no single fixed release), then drain and reboot each affected node - this is initiator code in the SCSI transport, there is no module reload or runtime mitigation. Until then, keep iSCSI traffic on an isolated storage VLAN with authenticated targets, since the whole attack depends on what the target is allowed to put on the wire.

References

Related entries

• Linux kernel libiscsi: negative task index from parse_pdu_itt reads before the command arrayCVE-2026-99154 · Linux kernel libiscsi / be2iscsi (negative PDU task index)Critical
• Linux kernel (drivers/pci/controller/dwc): A PCIe BAR window can end up larger than the memory actually backing it, soCVE-2024-58006 · Linux kernel (drivers/pci/controller/dwc)Critical
• Xen varstored (Xapi UEFI variable service, OVMF shared buffer): varstored runs in the host's control domain andCVE-2025-58151 · Xen varstored (Xapi UEFI variable service, OVMF shared buffer)Critical
• OpenSSH client: use-after-free when a server changes its host key during re-exchangeCVE-2026-60002 · OpenSSH ssh client (host key change during key re-exchange)Critical
• Linux kernel (net/core, net/tls): The bitmap that marks sk_msg scatterlist entries as externally owned was not carriedCVE-2026-63830 · Linux kernel (net/core, net/tls)Critical
• Proxmox VE: unauthenticated API login bypass via arbitrary tfa-challenge yields root@pamCVE-2023-54391 · Proxmox VE libpve-access-control (API ticket endpoint, tfa-challenge)Critical