CVE-2026-90011

CVE CVE-2026-90011EUVD EUVD-2026-80619Published 2026-09-16T10:33:18.000ZLast changed 2026-09-16T14:41:28.000ZCVSS 9.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 5.10.270; patch: 7.2.5; e48354ce078c079996f89d715dfa44814b4eba01 <5fac79f248c37774d1dd761406f83d25ca6ff8e4; patch: 6.6.157; patch: 0; e48354ce078c079996f89d715dfa44814b4eba01 <eb9dadf4d552ebe10644871c5189286552aa48f5; e48354ce078c079996f89d715dfa44814b4eba01 <6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076; patch: 6.1.188; patch: 6.18.51; patch: 5.15.221; e48354ce078c079996f89d715dfa44814b4eba01 <6ddddcad436d8e6e619204d3c848147ff2f5bf1e; e48354ce078c079996f89d715dfa44814b4eba01 <1624bff4c5118ad494d50ad94d44f22064667a7f; e48354ce078c079996f89d715dfa44814b4eba01 <f4825922d2fb371e2b969697d792077f1b62b62c; e48354ce078c079996f89d715dfa44814b4eba01 <3ddf3ea291a0ef2ea93b82e158960ac2cc42302b; patch: 7.3-rc2; e48354ce078c079996f89d715dfa44814b4eba01 <b19dc17ed963ac36c0db4b52a1803fb11169f91f; patch: 6.12.110; 3.1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.