CVE-2026-90011

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Reserve a terminator byte for the login payload

iscsi_target_check_login_request() rejects a login PDU whose

DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and

login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS

bytes. Since iscsit_get_login_rx() receives payload_length + padding

bytes, where

padding = ((-payload_length) & 3);

any payload_length from 8189 to 8192 fills the whole 8192 byte

buffer. The write stays in bounds, but no byte is left for a NUL

terminator.

The buffer is subsequently consumed as a C string. In the CHAP path

chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls

strstr(in_buf, pattern) followed by strlen_semi(), none of which take a

length. convert_null_to_semi() additionally rewrites every embedded NUL

to ';', so even a payload made of well formed NUL separated key=value

records is left without a terminator. These walk past

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References