CVE-2026-44944: open-iscsi Auth Bypass Vulnerability

CVE-2026-44944 Overview

CVE-2026-44944 is an incorrect authorization vulnerability [CWE-863] in open-iscsi that allows unprivileged local users to interact with the iscsiuio control socket. The flaw resides in the management interface handling within iscsiuio/src/unix/iscsid_ipc.c, where the peer credential check operates on the wrong file descriptor. As a result, non-root local users can send control commands intended only for administrative accounts. The issue affects open-iscsi up to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Critical Impact
Local unprivileged users can bypass the root-only authorization check on the iscsiuio control socket, enabling unauthorized configuration of iSCSI userspace I/O and potential privilege escalation on affected hosts.

Affected Products

open-iscsi project source builds up to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
Linux distributions packaging vulnerable open-iscsi / iscsiuio versions (see SUSE Bugzilla CVE-2026-44944)
Systems exposing the iscsiuio management socket to local users

Discovery Timeline

Reported by - Keith at Linneman Labs (credited in upstream commit #535)
2026-07-29 - CVE-2026-44944 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-44944

Vulnerability Analysis

The iscsiuio daemon exposes a Unix domain control socket used to manage iSCSI userspace I/O operations. Access to this socket must be restricted to the root user. In the vulnerable code path, the daemon accepts a new client connection on descriptor s2, but then calls mgmt_peeruser() against a different descriptor (iscsid_opts.fd) when validating the peer's identity. Because the peer credentials are read from the wrong socket, the check does not reflect the actual connecting process. An unprivileged local user connecting to the socket therefore passes the root comparison and is permitted to issue management commands.

A second issue addressed in the same patch relates to usr/discovery.c, where isns_config.ic_security is explicitly cleared before creating the iSNS source, reinforcing that security state must be initialized correctly during discovery.

Root Cause

The root cause is an argument mix-up in the authorization check. mgmt_peeruser(iscsid_opts.fd, user) inspects the wrong file descriptor rather than the newly accepted client socket s2. The comparison strncmp(user, "root", PEERUSER_MAX) then evaluates a username that is not tied to the caller, breaking the intended access control model.

Attack Vector

The vector is local. Any user with the ability to connect() to the iscsiuio control socket can trigger the flawed check and be treated as an administrative peer. No user interaction is required beyond executing a local process. Successful exploitation yields high impact to confidentiality, integrity, and availability of the iSCSI subsystem on the host.

// Patch excerpt: iscsiuio/src/unix/iscsid_ipc.c
// Source: https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
			continue;
 		}
 
-		if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) {
+		if (!mgmt_peeruser(s2, user) || strncmp(user, "root", PEERUSER_MAX)) {
 			close(s2);
 			ILOG_ERR(PFX "Access error: non-administrative connection rejected");
-			break;
+			continue;
 		}

 		/* this closes the file descriptor s2 */

The fix passes the accepted client descriptor s2 to mgmt_peeruser() so the credential check evaluates the actual caller. It also replaces break with continue, ensuring the daemon keeps servicing legitimate connections after rejecting an unauthorized one.

Detection Methods for CVE-2026-44944

Indicators of Compromise

Unexpected log entries from iscsiuio showing successful management operations initiated by non-root processes.
Connections to the iscsiuio Unix domain socket from UIDs other than 0 observed via audit logs.
Presence of open-iscsi binaries built from a commit predating 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Detection Strategies

Enable Linux audit rules on the iscsiuio control socket path to record connect() syscalls with caller UID and executable.
Inventory installed open-iscsi and iscsiuio package versions across Linux fleets and flag builds that do not include the upstream fix.
Correlate iscsiadm and iscsiuio process activity with the invoking user to surface non-administrative callers issuing management commands.

Monitoring Recommendations

Forward iscsiuio daemon logs and auditd events to a centralized data lake for retention and query.
Alert on any process outside expected administrative tooling that opens the iscsiuio management socket.
Track privilege escalation chains that begin with local unprivileged accounts interacting with iSCSI userspace components.

How to Mitigate CVE-2026-44944

Immediate Actions Required

Update open-iscsi to a build that includes commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e or the distribution package that backports the fix.
Audit which local users on iSCSI initiators can reach the iscsiuio control socket and remove unnecessary access.
Review recent iscsiuio activity for signs of unauthorized management operations before patching.

Patch Information

The upstream fix is available in the GitHub commit for open-iscsi. Distribution tracking is available at the SUSE Bugzilla CVE-2026-44944 entry. Apply vendor-provided packages once released; rebuild from source with the referenced commit if a packaged update is not yet available.

Workarounds

Restrict filesystem permissions on the iscsiuio control socket so only root can connect() to it.
Stop and disable the iscsiuio service on hosts that do not require iSCSI hardware offload while a patch is pending.
Limit local login and container escape paths on iSCSI initiator hosts to reduce the pool of users who could reach the socket.

bash

# Verify installed open-iscsi version and iscsiuio socket ownership
rpm -q open-iscsi || dpkg -l | grep open-iscsi
systemctl status iscsiuio
ls -l /run/iscsid.uio.sock 2>/dev/null || find / -name 'iscsid.uio*' -type s 2>/dev/null

# Temporarily disable iscsiuio where not required
sudo systemctl stop iscsiuio.socket iscsiuio.service
sudo systemctl disable iscsiuio.socket iscsiuio.service