CVE-2026-72084

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Bound PR-OUT TransportID parsing to the received buffer

core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move()

hand the raw PERSISTENT RESERVE OUT parameter buffer to

target_parse_pr_out_transport_id() without telling it how many bytes are

valid. For an iSCSI TransportID (FORMAT CODE 01b),

iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with

an unbounded strstr() (and on the error path prints the name with a further

unbounded "%s"). An initiator can submit a TransportID whose iSCSI name

contains neither a ",i,0x" substring nor a NUL terminator, filling the

parameter list to its end, so the scan runs off the end of the buffer.

When the parameter list spans more than one page the buffer is a multi-page

vmap (transport_kmap_data_sg()), so the over-read walks into the trailing

vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It

is reachable

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References