Improper input validation in Linux kernel - CVE-2026-99153
Published: October 29, 2026
Vulnerability identifier: #VU158432
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99153
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service or compromise data integrity by incorrectly completing SCSI commands.
The vulnerability exists due to improper validation of the reflected initiator task tag in the Linux kernel libiscsi iscsi_handle_reject() function when processing iSCSI Reject PDUs. A remote attacker can send a specially crafted Reject PDU from a malicious iSCSI target to select an unrelated task, triggering a NULL pointer dereference, a reference-count underflow, or successful completion of an in-flight SCSI command without the expected data transfer.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99153
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2