SB20260816144 - Heap-based buffer overflow in Linux kernel scsi driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.

The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b
• https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7
• https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676
• https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6
• https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233