Linux kernel libiscsi: negative task index from parse_pdu_itt reads before the command array

Impact

Both libiscsi task lookups bound the transport-supplied index from above only (if (i >= session->cmds_max)), and because both the index and cmds_max are signed ints a negative value passes the check and session->cmds[i] is read from memory before the array. be2iscsi actually produces one: beiscsi_parse_pdu() assigns the raw tag and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring with the target's ITT intact, and it reports the session's own age rather than the one in the tag, so the age comparison in iscsi_verify_itt() has nothing left to reject. The result is an out-of-bounds read turned into a bogus task pointer - kernel memory disclosure or a crash on a node that is doing iSCSI storage I/O. This is a different code path and a different fix from the Reject-PDU ITT bug (CVE-2026-99153); it needs an Emulex/Broadcom be2iscsi offload HBA to be reachable in practice.

Who can reach it

Reachable from the iSCSI target or from an attacker on the storage network who can inject into the initiator's session; no local access and no additional authentication. Requires a transport that implements parse_pdu_itt - in the reported case the be2iscsi offload driver. Nodes with no iSCSI initiator, or using software iSCSI only, are much less exposed.

What to do

Move to a stable kernel carrying the fix that bounds the index from below in both lookups (five stable commits are linked in the record; no single fixed release is named), then drain and reboot each node running be2iscsi hardware. No runtime mitigation exists short of unbinding the offload initiator; restricting which targets the node logs into reduces who can supply the tag.

References

Related entries

• Linux kernel (drivers/pci/controller/dwc): A PCIe BAR window can end up larger than the memory actually backing it, soCVE-2024-58006 · Linux kernel (drivers/pci/controller/dwc)Critical
• Xen varstored (Xapi UEFI variable service, OVMF shared buffer): varstored runs in the host's control domain andCVE-2025-58151 · Xen varstored (Xapi UEFI variable service, OVMF shared buffer)Critical
• OpenSSH client: use-after-free when a server changes its host key during re-exchangeCVE-2026-60002 · OpenSSH ssh client (host key change during key re-exchange)Critical
• Linux kernel (net/core, net/tls): The bitmap that marks sk_msg scatterlist entries as externally owned was not carriedCVE-2026-63830 · Linux kernel (net/core, net/tls)Critical
• Proxmox VE: unauthenticated API login bypass via arbitrary tfa-challenge yields root@pamCVE-2023-54391 · Proxmox VE libpve-access-control (API ticket endpoint, tfa-challenge)Critical
• VMware ESXi / Workstation / Fusion: Use-after-free in the XHCI USB controllerCVE-2024-22252 · VMware ESXi / Workstation / FusionCritical