{"id":"CVE-2026-98479","kind":"vulnerability","aliases":["CVE-2026-98479"],"related":[],"title":"Linux kernel iSCSI: malicious target can overwrite write buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.","summary":"The Linux kernel iSCSI TCP initiator accepted a Data-In PDU for a command that was writing, so a malicious or compromised iSCSI target can inject its own bytes into the initiator's write buffers. The result is silent data corruption in O_DIRECT and page-cache writes, with the target's data read back from the cache.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iscsi","kernel","linux","self-hosted","storage"],"not_affected_if":["managed-hosting","no-iscsi"],"how_to_check":"- Run `uname -r` and compare against the kernel version that includes the iscsi_tcp Data-In direction fix in the vendor's advisory\n- Check whether the iSCSI initiator module is loaded with `lsmod | grep libiscsi_tcp`\n- Check for active iSCSI sessions with `iscsiadm -m session`","fix":"- Update the Linux kernel to a release that includes the upstream libiscsi_tcp direction check (version unknown from these sources)\n- Restrict iSCSI targets to trusted hosts until patched","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:53+00:00","updated_at":"2026-10-25T05:25:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream libiscsi_tcp direction check (version unknown from these sources)\n- Restrict iSCSI targets to trusted hosts until patched","reach":"network","title":"Linux kernel iSCSI: malicious target can overwrite write buffers","impact":"medium","summary":"The Linux kernel iSCSI TCP initiator accepted a Data-In PDU for a command that was writing, so a malicious or compromised iSCSI target can inject its own bytes into the initiator's write buffers. The result is silent data corruption in O_DIRECT and page-cache writes, with the target's data read back from the cache.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","iscsi","storage","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Target bytes overwrite initiator write buffers, silently corrupting stored data","analyst_note":"Find the upstream kernel fix commit and the affected/fixed version ranges in NVD or kernel.org stable trees; the sources give no version.","how_to_check":"- Run `uname -r` and compare against the kernel version that includes the iscsi_tcp Data-In direction fix in the vendor's advisory\n- Check whether the iSCSI initiator module is loaded with `lsmod | grep libiscsi_tcp`\n- Check for active iSCSI sessions with `iscsiadm -m session`","needs_analyst":true,"not_affected_if":["no-iscsi","managed-hosting"],"who_is_affected":"Hosts running the Linux kernel's iSCSI TCP initiator (libiscsi_tcp) that connect to iSCSI targets and perform writes. The exposure depends on trusting the target, since the flaw needs a target that sends a Data-In for a write command. Hosts without iSCSI initiator use can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":3659,"output_tokens":690,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98479':12A,15A '128':233C '131072':264C '512':226C,254C 'accept':30B 'alreadi':310C 'answer':168C 'ask':136C,151C 'back':80B,280C 'block':279C 'branch':111C 'buffer':9A,59B,216C,250C,265C 'byte':53B,187C,227C,255C,285C 'cach':72B,83B,212C,290C 'caller':200C,248C 'check':97C,298C 'command':38B,132C,139C,158C,171C,293C 'compromis':46B 'copi':124C 'corrupt':65B 'cve':10A,13A 'data':33B,64B,78B,99C,104C,109C,128C,177C,229C,260C 'data-in':32B,103C,108C,176C,228C 'devic':164C 'direct':68B,100C,208C,246C,300C 'dissect':116C 'dma':162C 'emit':224C 'end':251C 'file':149C 'follow':89C 'fsync':270C 'go':294C 'hdr':115C 'hold':253C 'host':22B 'infrastructur':16B 'initi':29B,56B,182C 'inject':50B 'iscsi':3A,17B,27B,47B,113C,142C 'itt':119C,173C,237C 'kb':234C 'kernel':2A,18B,26B,87C 'libiscsi':95C 'linux':1A,19B,25B,86C 'log':275C 'malici':4A,44B 'name':231C 'noth':273C 'o':67B,207C,245C 'observ':218C 'one':217C,225C 'overwrit':7A 'page':71B,190C,204C,211C,213C,289C 'page-cach':70B 'path':309C 'pdu':35B,106C,126C 'pin':203C 'pwrite':262C,268C 'quieter':267C 'r2t':144C,155C,240C,308C 'read':79B,141C,277C 'reject':153C 'resolv':93C,117C 'result':61B 'return':263C,281C 'rsp':145C 'scatterlist':134C,304C 'scsi':94C 'segment':129C 'self':21B 'self-host':20B 'send':196C 'silent':63B 'storag':23B 'succeed':272C 'suppli':186C 'target':5A,48B,76B,166C,185C,222C,258C,283C 'target-suppli':184C 'task':122C 'tcp':28B,96C,114C,143C 'test':221C 'therefor':179C 'use':302C 'vulner':90C 'way':306C 'whether':137C 'wire':297C 'without':135C,291C 'write':8A,41B,58B,73B,170C,183C,192C,209C,235C,243C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Linux kernel's iSCSI TCP initiator (libiscsi_tcp) that connect to iSCSI targets and perform writes. The exposure depends on trusting the target, since the flaw needs a target that sends a Data-In for a write command. Hosts without iSCSI initiator use can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98479","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}