Improper input validation in Linux kernel - CVE-2026-98479

Vulnerability identifier: #VU156779

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98479

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to corrupt application write buffers and cached file data on an iSCSI initiator.

The vulnerability exists due to insufficient validation of command data direction in the Linux kernel's libiscsi_tcp component when processing a Data-In PDU referencing a WRITE command. A remote attacker can operate a malicious iSCSI target and send a Data-In PDU naming an outstanding WRITE command's initiator task tag to overwrite the caller's pinned pages for a direct write or page cache pages for a buffered write with target-supplied data.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b
• https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931
• https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296
• https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df
• https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db
• https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2
• https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03
• https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8

• Improper input validation in Linux kernel scsi driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more