CVE-2026-80691 Overview
CVE-2026-80691 is a NULL pointer dereference vulnerability in the Linux kernel's SCSI target subsystem. The flaw resides in the iblock_execute_pr_out() function within the iblock backend of the SCSI target module. The function fails to validate whether required Persistent Reservation (PR) callback operations are implemented before invoking them. When processing PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, or PRO_RELEASE service actions, the code checks ops->pr_clear instead of the specific hook being called, allowing unimplemented function pointers to be dereferenced. The result is a kernel crash and denial of service.
Critical Impact
A remote attacker with access to SCSI target services can trigger a NULL function pointer dereference, causing a kernel panic and host-wide denial of service.
Affected Products
- Linux kernel SCSI target subsystem (drivers/target/target_core_iblock.c)
- Linux distributions shipping affected stable kernel branches prior to the fix commits
- Storage systems exposing LIO/iSCSI targets backed by iblock devices
Discovery Timeline
- 2026-08-28 - CVE-2026-80691 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80691
Vulnerability Analysis
The SCSI target iblock backend implements SCSI-3 Persistent Reservations (PR) through a set of optional callback operations. The iblock_execute_pr_out() function dispatches PR OUT service actions to backend-specific handlers via the ops structure. For the PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE service actions, the function performs a capability check against ops->pr_clear, which is the incorrect hook. The handlers actually invoked for these service actions are pr_preempt and pr_release. When a backend implements pr_clear but not pr_preempt or pr_release, the guard passes and the kernel dereferences a NULL function pointer.
Root Cause
The root cause is an incorrect NULL-check target in the PR OUT dispatch path [CWE-476]. The code validates the presence of one callback while invoking a different one. This logic error means the guard clause does not enforce the invariant it appears to enforce, permitting execution to reach an unimplemented function pointer.
Attack Vector
The vulnerability is reachable over the network on hosts exposing SCSI target services such as iSCSI. An attacker capable of issuing SCSI PR OUT commands to a target LUN backed by iblock can send a PREEMPT, PREEMPT_AND_ABORT, or RELEASE service action against a backend that lacks the corresponding hook. The resulting NULL pointer dereference crashes the kernel, producing a denial-of-service condition on the storage host. No memory corruption or code execution primitive has been reported; the impact is limited to availability.
See the upstream fix commits for the code-level change, including kernel commit a326b19cfb7 and kernel commit f15bcf9a99b.
Detection Methods for CVE-2026-80691
Indicators of Compromise
- Kernel oops or panic logs referencing iblock_execute_pr_out in the call trace
- BUG: kernel NULL pointer dereference entries originating from the target_core_iblock module
- Unexpected LIO/iSCSI target service restarts or host reboots following SCSI PR OUT traffic
Detection Strategies
- Monitor dmesg and syslog for NULL pointer dereference traces within the SCSI target stack
- Correlate SCSI PR OUT commands (opcode 0x5F) with PREEMPT, PREEMPT_AND_ABORT, and RELEASE service actions against iblock-backed LUNs
- Alert on abnormal iSCSI session terminations paired with target host reachability loss
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) on storage hosts running LIO targets to capture faults for triage
- Ingest kernel logs into a centralized log platform and alert on target_core_iblock stack traces
- Baseline SCSI PR OUT command volume from each initiator and flag anomalous spikes or unauthorized initiators
How to Mitigate CVE-2026-80691
Immediate Actions Required
- Update affected hosts to a Linux kernel version containing the upstream fixes listed in the kernel.org stable references
- Restrict network access to iSCSI and other SCSI target service ports to trusted initiator networks only
- Enforce initiator authentication (for example, CHAP for iSCSI) and ACLs on all exported LUNs
Patch Information
The issue is resolved upstream by adding capability checks against the specific hooks invoked for each PR OUT service action, ensuring pr_preempt and pr_release are non-NULL before dispatch. Fix commits are available in the stable trees, including 3c60a8b4037, 9c33222bd3, a326b19cfb7, bdd8a1297ef, and f15bcf9a99b. Consume the fix through your distribution's kernel package channel.
Workarounds
- Disable persistent reservation usage on iblock-backed LUNs where operationally feasible until the kernel is patched
- Limit initiator access to only those clients that require PR semantics, reducing exposure to malicious PR OUT commands
- Isolate SCSI target hosts on dedicated storage VLANs and block SCSI target ports at the perimeter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
