Answer in brief
CVE-2026-90011 records a Critical severity (CVSS 9.1) vulnerability in scsi: target: iscsi: Reserve a terminator byte for the login payload. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e48354ce078c079996f89d715dfa44814b4eba01 <5fac79f248c37774d1dd761406f83d25ca6ff8e4 || >=e48354ce078c079996f89d715dfa44814b4eba01 <6ddddcad436d8e6e619204d3c848147ff2f5bf1e || >=e48354ce078c079996f89d715dfa44814b4eba01 <b19dc17ed963ac36c0db4b52a1803fb11169f91f || >=e48354ce078c079996f89d715dfa44814b4eba01 <6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076 || >=e48354ce078c079996f89d715dfa44814b4eba01 <eb9dadf4d552ebe10644871c5189286552aa48f5 || >=e48354ce078c079996f89d715dfa44814b4eba01 <1624bff4c5118ad494d50ad94d44f22064667a7f || >=e48354ce078c079996f89d715dfa44814b4eba01 <3ddf3ea291a0ef2ea93b82e158960ac2cc42302b || >=e48354ce078c079996f89d715dfa44814b4eba01 <f4825922d2fb371e2b969697d792077f1b62b62c | 5fac79f248c37774d1dd761406f83d25ca6ff8e4, 6ddddcad436d8e6e619204d3c848147ff2f5bf1e, b19dc17ed963ac36c0db4b52a1803fb11169f91f, 6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076, eb9dadf4d552ebe10644871c5189286552aa48f5, 1624bff4c5118ad494d50ad94d44f22064667a7f, 3ddf3ea291a0ef2ea93b82e158960ac2cc42302b, f4825922d2fb371e2b969697d792077f1b62b62c |
| Linux/Linuxgeneric | 3.1 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.
Quoted source text, attributed separately from HOL analysis.