SB20261029157 - Improper input validation in Linux kernel scsi driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-99153)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or compromise data integrity by incorrectly completing SCSI commands.

The vulnerability exists due to improper validation of the reflected initiator task tag in the Linux kernel libiscsi iscsi_handle_reject() function when processing iSCSI Reject PDUs. A remote attacker can send a specially crafted Reject PDU from a malicious iSCSI target to select an unrelated task, triggering a NULL pointer dereference, a reference-count underflow, or successful completion of an in-flight SCSI command without the expected data transfer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8
• https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d
• https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a