{"id":"CVE-2026-99153","kind":"vulnerability","aliases":["CVE-2026-99153"],"related":[],"title":"Linux kernel: iSCSI Reject PDU can complete arbitrary tasks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task->conn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[    6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[    6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[    6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[    6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[    6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[    6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[    6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[    6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[    6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[    6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[    6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[    6.254549] FS:  0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[    6.254887] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[    6.255439] PKRU: 55555554\n[    6.255564] Call Trace:\n[    6.255674]  <IRQ>\n[    6.255768]  __iscsi_complete_pdu+0x18bf/0x22a0\n[    6.256733]  iscsi_complete_pdu+0x54/0xa0\n[    6.256905]  iscsi_tcp_data_recv_done+0xf4/0x250\n[    6.257103]  iscsi_tcp_recv_skb+0x31e/0xec0\n[    6.257680]  iscsi_sw_tcp_recv+0x12f/0x390\n[    6.258061]  __tcp_read_sock+0x1ab/0x810\n[    6.258853]  iscsi_sw_tcp_data_ready+0x18b/0x510\n[    6.259808]  tcp_data_queue+0x1f13/0x4cd0\n[    6.260567]  tcp_rcv_established+0x8a5/0x3a00\n[    6.261931]  tcp_v4_do_rcv+0x449/0x960\n[    6.262269]  tcp_v4_rcv+0x2245/0x3bc0","summary":"The Linux kernel's iSCSI initiator (libiscsi) trusts the task tag in a Reject PDU sent by the target, so a malicious or compromised target can name any task in the pool. This can crash the kernel or complete an in-flight SCSI read as successful without its data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iscsi","kernel","linux","self-hosted","storage"],"not_affected_if":["iscsi-modules-not-loaded","no-iscsi-in-use"],"how_to_check":"- `uname -r` to see the running kernel version, then compare with the fixed kernel in the vendor advisory\n- `lsmod | grep -i iscsi` to check whether the iSCSI initiator modules (libiscsi, iscsi_tcp) are loaded\n- unknown whether the sources give a specific affected version range","fix":"- Update to a Linux kernel release that includes the upstream libiscsi fix (the commit validating the ITT in iscsi_handle_reject), via your distribution's kernel package\n- unknown whether a specific fixed version number is given by the sources","status":"open","published_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:35:55+00:00","updated_at":"2026-10-28T11:35:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:35:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream libiscsi fix (the commit validating the ITT in iscsi_handle_reject), via your distribution's kernel package\n- unknown whether a specific fixed version number is given by the sources","reach":"network","title":"Linux kernel: iSCSI Reject PDU can complete arbitrary tasks","impact":"medium","summary":"The Linux kernel's iSCSI initiator (libiscsi) trusts the task tag in a Reject PDU sent by the target, so a malicious or compromised target can name any task in the pool. This can crash the kernel or complete an in-flight SCSI read as successful without its data.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","iscsi","storage","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crash or silent data corruption from a malicious iSCSI target","analyst_note":"Check the kernel.org stable commit and distro advisories for the fixed version range and any CVSS score; NVD gave no severity.","how_to_check":"- `uname -r` to see the running kernel version, then compare with the fixed kernel in the vendor advisory\n- `lsmod | grep -i iscsi` to check whether the iSCSI initiator modules (libiscsi, iscsi_tcp) are loaded\n- unknown whether the sources give a specific affected version range","needs_analyst":true,"not_affected_if":["no-iscsi-in-use","iscsi-modules-not-loaded"],"who_is_affected":"Only hosts using the Linux iSCSI initiator to reach storage targets are exposed, since the flaw is in how the initiator handles Reject PDUs from the target. The exploit path needs a target that sends a crafted Reject PDU, so systems that use no iSCSI or only trusted targets are less at risk. Systems that do not load the iSCSI modules can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000845,"input_tokens":4939,"output_tokens":703,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':354C,500C,506C,514C,521C,528C,534C,542C,548C,554C,561C,567C '-2':347C '-2026':11A,14A '-99153':12A,15A '0':314C,316C,353C '00':368C,372C,373C,374C,377C,378C,379C,380C,381C,403C,407C,408C,409C,421C '0000':294C,467C,470C,477C,479C '0000000000000000':444C,446C,456C,459C,463C,466C,472C '0000000000000003':451C '000000000000000c':437C '0000000000000060':441C '0000000000770ef0':488C '0000000005252006':486C '0000000080050033':481C '00007fc393e8ffc0':484C '00010206':427C '0010':351C,475C '0018':424C '02':367C,402C '03':360C,399C '04/01/2014':348C '08':364C '0f':369C,404C '0x0000000000000060':308C '0x0000000000000060-0x0000000000000067':307C '0x0000000000000067':309C '0xdffffc000000000c':293C '1':241C,295C,312C,326C '1.16.3':344C,346C '1048576':245C '1996':342C '24.04':334C '39':415C '3c':366C,401C '45':412C '48':361C,375C,385C,389C,393C,396C,410C,414C,419C '50':418C '55555554':491C '58':388C '6.248477':282C '6.249357':299C '6.249951':310C '6.250718':329C '6.251616':349C '6.252043':356C '6.252813':422C '6.253042':428C '6.253345':435C '6.253642':442C '6.253947':449C '6.254251':457C '6.254549':464C '6.254887':473C '6.255140':482C '6.255439':489C '6.255564':492C '6.255674':495C '6.255768':496C '6.256733':502C '6.256905':508C '6.257103':516C '6.257680':523C '6.258061':530C '6.258853':536C '6.259808':544C '6.260567':550C '6.261931':556C '6.262269':563C '60':392C,413C '6b':387C '7.2.0':321C '74':417C '7463656e6':453C '7d':391C '80':365C,400C '83':362C '85':370C,405C '89':394C '8b':386C,411C '8d':390C 'address':292C 'alloc':205C 'arbitrari':8A 'arch':339C 'assign':199C 'b8':376C,420C 'bio':343C 'bound':150C 'buffer':250C 'c0':406C 'c1':358C,397C 'c3':416C 'call':493C 'canon':291C 'cap':340C 'carri':97C 'check':157C 'clean':121C 'cmds':154C 'code':357C 'comm':317C 'command':235C,267C,281C 'complet':7A,62B,175C,214C,237C,498C,504C 'compromis':47B 'conn':136C,188C,197C 'copi':99C,115C 'cpu':311C 'cr0':480C 'cr2':483C 'cr3':485C 'cr4':487C 'crash':58B 'cs':474C 'ctask':264C 'cve':10A,13A 'data':73B,126C,511C,540C,546C 'debian':345C 'deref':304C 'df':384C 'dffffc0000000000':430C 'done':513C 'ds':476C 'e6f6320':454C 'ea':359C,398C 'ec':363C 'eflag':426C 'els':159C 'es':478C 'establish':553C 'f5':371C 'fa':395C 'fault':286C 'fc':382C 'ff':383C 'ffff88800607e000':432C 'ffff88806c907b80':425C 'ffff88806c907c38':439C,461C 'ffff8880d95bc000':469C 'fffffbfff235a504':448C 'ffffffff8d571a25':434C 'find':117C 'fix':341C 'flight':66B,233C,276C 'follow':79C 'free':225C 'fs':465C 'general':284C 'gf5098b6bae76':325C 'give':184C 'gs':468C 'handl':107C 'hardwar':330C 'hdr':130C 'header':102C 'hit':216C 'host':22B 'i440fx':337C 'in-flight':64B,231C 'index':152C,178C 'infrastructur':16B 'initi':29B 'iscsi':3A,17B,28B,106C,129C,132C,146C,170C,213C,223C,261C,497C,503C,509C,517C,524C,537C 'iscsi1':324C 'iscsi_nop_out_rsp.constprop':352C 'itt':88C,111C,133C,147C,258C,262C,268C 'kasan':297C,300C 'kernel':2A,18B,26B,60B,77C 'knlgs':471C 'lazi':328C 'libiscsi':30B,85C 'linux':1A,19B,25B,76C 'malici':45B 'max':155C 'memcpi':123C 'mib':242C 'name':50B,168C,331C 'never':181C 'non':290C 'non-canon':289C 'none':247C 'nop':171C 'nopti':298C 'noth':158C 'null':186C,302C 'null-ptr-deref':301C 'oop':283C 'pc':335C 'pdu':5A,38B,93C,96C,125C,499C,505C 'pid':315C 'piix':338C 'pkru':490C 'pool':55B,165C,190C 'preempt':327C 'probabl':287C 'protect':285C 'ptr':303C 'put':144C 'qemu':332C 'queue':547C 'r08':445C 'r09':447C 'r10':450C 'r11':452C 'r12':455C 'r13':458C 'r14':460C 'r15':462C 'rang':306C 'rax':429C 'rbp':443C 'rbx':431C 'rc5':323C 'rc5-iscsi1-gf5098b6bae76':322C 'rcv':552C,560C,566C 'rcx':433C 'rdi':440C 'rdx':436C 'read':68B,243C,532C 'readi':541C 'recv':512C,519C,527C 'refcount':228C 'reflect':89C,257C 'reject':4A,37B,92C,95C,104C,108C,124C 'rejected_pdu.itt':137C 'requir':270C 'resolv':83C 'return':212C,244C 'rip':350C 'rsi':438C 'rsp':173C,423C 'scsi':67B,84C,234C,280C 'self':21B 'self-host':20B 'sent':39B 'session':194C 'setup':195C 'sizeof':127C 'skb':520C 'smp':296C 'sock':533C 'state':222C 'storag':23B 'struct':128C 'success':70B,239C 'sw':525C,538C 'swapper/1':318C 'tag':34B 'taint':320C 'take':109C 'target':42B,48B,143C 'task':9A,33B,52B,119C,131C,135C,149C,162C,187C,203C,208C,215C,221C,224C,272C 'tcp':510C,518C,526C,531C,539C,545C,551C,557C,564C 'trace':494C 'trust':31B 'ubuntu':333C 'uid':313C 'underflow':229C 'use':183C,210C 'v2':336C 'v4':558C,565C 'valid':86C,255C,265C 'valu':139C 'vulner':80C 'warn':218C,254C 'way':260C 'whatev':141C 'without':71B 'written':251C 'x12f/0x390':529C 'x18b/0x510':543C 'x18bf/0x22a0':501C 'x1ab/0x810':535C 'x1f13/0x4cd0':549C 'x2245/0x3bc0':568C 'x31e/0xec0':522C 'x449/0x960':562C 'x46/0x160':355C 'x54/0xa0':507C 'x8a5/0x3a00':555C 'xf4/0x250':515C 'zero':192C","nicknames":[],"mitigations":[],"who_affected":"Only hosts using the Linux iSCSI initiator to reach storage targets are exposed, since the flaw is in how the initiator handles Reject PDUs from the target. The exploit path needs a target that sends a crafted Reject PDU, so systems that use no iSCSI or only trusted targets are less at risk. Systems that do not load the iSCSI modules can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99153","severity":null,"published_at":"2026-10-28T11:17:35+00:00","modified_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}