CVE-2026-46149: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46149 Overview

CVE-2026-46149 is an out-of-bounds read vulnerability in the Linux kernel SCSI target subsystem. The flaw resides in target_tg_pt_gp_members_show() within target_core_configfs, which formats LUN paths into a 256-byte stack buffer using snprintf(). Because snprintf() returns the length the output would have had rather than the bytes written, a long fabric WWN such as an iSCSI Qualified Name (IQN) up to 223 bytes can cause memcpy() to read beyond the stack buffer. The copy leaks adjacent stack contents to sysfs readers, and on kernels built with CONFIG_FORTIFY_SOURCE, the condition triggers fortify_panic().

Critical Impact
A local user with access to the target configfs sysfs attributes can read uninitialized stack memory or trigger a kernel panic on hardened builds.

Affected Products

Linux kernel SCSI target subsystem (drivers/target/target_core_configfs.c)
Distributions shipping kernels exposing the tg_pt_gp_members configfs attribute
Systems with CONFIG_FORTIFY_SOURCE enabled (susceptible to panic)

Discovery Timeline

2026-05-28 - CVE-2026-46149 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46149

Vulnerability Analysis

The vulnerability resides in target_tg_pt_gp_members_show(), the configfs handler that lists Target Port Group members. The function formats each LUN path with snprintf() into a fixed 256-byte stack buffer, then issues memcpy() using the value returned by snprintf() as cur_len. Per C library semantics, snprintf() returns the number of characters that would have been written if the buffer were unbounded, not the number actually written. When the fabric World Wide Name is long — iSCSI IQNs may reach 223 bytes — the formatted string is truncated in the stack buffer, but cur_len exceeds 256.

The subsequent memcpy(page, buf, cur_len) therefore reads past the end of the 256-byte source buffer. The bounds check at the memcpy() call site validated only the destination page write, not the source read. Adjacent stack contents are copied into the sysfs page returned to user space. On kernels compiled with CONFIG_FORTIFY_SOURCE, fortified memcpy() detects the over-read against the known source object size and invokes fortify_panic(), halting the system.

Root Cause

The root cause is misuse of the snprintf() return value as a copy length without clamping it to the buffer size. A prior fix, commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow"), applied a clamp to target_lu_gp_members_show() but missed the parallel tg_pt_gp variant. This is classified as an out-of-bounds read [CWE-125] driven by improper handling of a return value.

Attack Vector

Exploitation requires local access to the target configfs hierarchy under /sys/kernel/config/target/, typically restricted to privileged users administering SCSI targets. An attacker configures a fabric with a maximally long WWN/IQN, then reads the members attribute of a target port group. The read returns kernel stack memory beyond the formatting buffer, potentially exposing pointers or sensitive values. On fortified kernels, the same read triggers fortify_panic() and produces a denial-of-service condition.

No verified proof-of-concept code has been published. The upstream resolution is documented in the kernel commits listed under references, including Linux Kernel Commit 00d91bf and Linux Kernel Commit 1f678d1.

Detection Methods for CVE-2026-46149

Indicators of Compromise

Unexpected kernel panics referencing fortify_panic and target_tg_pt_gp_members_show in dmesg or /var/log/kern.log.
Reads against /sys/kernel/config/target/core/*/*/alua/*/members correlated with creation of unusually long fabric WWN or IQN identifiers.
Configfs targets configured with IQN strings approaching the 223-byte maximum.

Detection Strategies

Audit kernel logs for fortify_panic events tied to the SCSI target subsystem.
Inventory hosts running the LIO target stack (targetcli, rtslib, kernel modules target_core_mod, iscsi_target_mod) and check kernel versions against patched stable releases.
Monitor configfs write operations creating new target port groups or fabric WWNs with abnormal length.

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a centralized analytics pipeline for anomaly review.
Alert on root or privileged account activity creating or modifying /sys/kernel/config/target/ objects outside of change windows.
Track kernel build flags across the fleet to identify hosts where CONFIG_FORTIFY_SOURCE is disabled and the over-read could silently leak data.

How to Mitigate CVE-2026-46149

Immediate Actions Required

Apply the upstream stable kernel updates that backport the tg_pt_gp_members_show() bound check.
Restrict access to /sys/kernel/config/target/ to administrative accounts only and remove unnecessary privileged shells on storage hosts.
Validate that fabric WWN and IQN strings provisioned on affected hosts remain within safe lengths until patches are deployed.

Patch Information

The fix bounds the snprintf() return value before it is used as the memcpy() source length, mirroring the earlier remediation applied to target_lu_gp_members_show(). Patched commits include Linux Kernel Commit 00d91bf, Linux Kernel Commit 1f678d1, Linux Kernel Commit 72cc5ea, Linux Kernel Commit 772a896, and Linux Kernel Commit e501154. Rebuild or update vendor kernels and reboot affected hosts.

Workarounds

Unload the LIO target modules (target_core_mod, iscsi_target_mod) on systems that do not require SCSI target functionality.
Constrain provisioned IQN and fabric WWN lengths so that the formatted LUN path stays within 256 bytes.
Enable CONFIG_FORTIFY_SOURCE in custom kernels to convert the over-read into a detectable panic rather than a silent stack leak.

bash

# Verify whether the LIO target subsystem is in use and audit configfs access
lsmod | grep -E 'target_core_mod|iscsi_target_mod'
ls -la /sys/kernel/config/target/ 2>/dev/null

# Confirm the running kernel includes the fix once patches are applied
uname -r
dmesg | grep -i fortify_panic