Answer in brief
CVE-2026-74557 records a Unknown severity vulnerability in scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <7567f06abdefb1caf2d836107c4d08c5185c650e || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <60499924faf4ef97e84228c20515218ef121facf || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <3ef209ca0b4b68c75e9a814d90cc916026b5a6ac || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <1f07a897d43c63e6c9458bf77450defef39b5833 || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <98b87885de4b7f605533a2860685f5689fce8e82 | 7567f06abdefb1caf2d836107c4d08c5185c650e, 60499924faf4ef97e84228c20515218ef121facf, 3ef209ca0b4b68c75e9a814d90cc916026b5a6ac, 1f07a897d43c63e6c9458bf77450defef39b5833, 98b87885de4b7f605533a2860685f5689fce8e82 |
| Linux/Linuxgeneric | 2.6.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74557 records a Unknown severity vulnerability in scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <7567f06abdefb1caf2d836107c4d08c5185c650e || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <60499924faf4ef97e84228c20515218ef121facf || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <3ef209ca0b4b68c75e9a814d90cc916026b5a6ac || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <1f07a897d43c63e6c9458bf77450defef39b5833 || >=7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 <98b87885de4b7f605533a2860685f5689fce8e82 | 7567f06abdefb1caf2d836107c4d08c5185c650e, 60499924faf4ef97e84228c20515218ef121facf, 3ef209ca0b4b68c75e9a814d90cc916026b5a6ac, 1f07a897d43c63e6c9458bf77450defef39b5833, 98b87885de4b7f605533a2860685f5689fce8e82 |
| Linux/Linuxgeneric | 2.6.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.
Quoted source text, attributed separately from HOL analysis.