CVE-2026-90011: Linux Kernel iSCSI Buffer Overflow Vulnerability

CVE-2026-90011 Overview

CVE-2026-90011 is an out-of-bounds read vulnerability in the Linux kernel's iSCSI target subsystem (drivers/target/iscsi). The flaw resides in iscsi_target_check_login_request(), which allocates the login->req_buf with exactly MAX_KEY_VALUE_PAIRS (8192) bytes but fails to reserve a byte for a NUL terminator. An unauthenticated remote initiator can send a login PDU whose DataSegmentLength fills the entire buffer, leaving no terminator before the payload is consumed as a C string. Downstream helpers including kstrdup(), strstr(), strlen_semi(), and convert_null_to_semi() then read past the buffer into adjacent slab memory.

Critical Impact
An unauthenticated remote attacker can trigger out-of-bounds reads in kernel slab memory against any iSCSI portal configured for CHAP authentication, enabling information disclosure and potential denial of service.

Affected Products

Linux kernel iSCSI target driver (scsi: target: iscsi)
Systems exposing an iSCSI target portal configured with CHAP authentication
Multiple stable kernel branches (patched via commits 1624bff, 3ddf3ea, 5fac79f, 6b589ef, 6ddddca, b19dc17, eb9dadf, f482592)

Discovery Timeline

2026-09-16 - CVE-2026-90011 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90011

Vulnerability Analysis

The vulnerability lives in iscsi_target_check_login_request(). The function rejects login PDUs whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the comparison uses > rather than >=. The login->req_buf buffer is allocated with exactly MAX_KEY_VALUE_PAIRS (8192) bytes.

iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3). Any payload_length between 8189 and 8192 fills the entire 8192-byte buffer. The write itself stays within bounds, but no byte remains for a NUL terminator.

The buffer is then treated as a C string. In the Challenge Handshake Authentication Protocol (CHAP) path, chap_check_algorithm() invokes kstrdup(a_str), while extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(). None of these functions accept a length argument. convert_null_to_semi() additionally rewrites every embedded NUL byte to ;, so even well-formed NUL-separated key=value records leave the buffer without a terminator. Each of these operations reads past the end of the allocation into adjacent slab memory.

Root Cause

The root cause is an off-by-one allocation error. kzalloc(MAX_KEY_VALUE_PAIRS, ...) allocates exactly the maximum accepted payload size without reserving a trailing terminator byte. The upstream fix allocates one extra byte, which kzalloc() zero-initializes and no writer touches, guaranteeing the buffer is always NUL-terminated.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An unauthenticated iSCSI initiator connects to a target portal configured for CHAP, then sends a login PDU with a DataSegmentLength in the range 8189–8192. When the CHAP path parses the unterminated payload, adjacent slab memory contents flow into string operations. When authentication is not required, iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the vulnerable CHAP path is not entered, so only CHAP-configured portals are reachable.

No verified proof-of-concept code is publicly available. See the kernel commit references for the exact patch diffs.

Detection Methods for CVE-2026-90011

Indicators of Compromise

Repeated iSCSI login PDUs from a single initiator with DataSegmentLength values between 8189 and 8192 bytes
Kernel log entries referencing iscsi_target_check_login_request, chap_check_algorithm, or extract_param accompanied by KASAN slab-out-of-bounds reports
Unexpected iSCSI target process crashes or LIO subsystem oops messages under active login traffic

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to observe out-of-bounds reads triggered by malformed CHAP login payloads
Inspect network captures on TCP 3260 for iSCSI Login Request PDUs whose data segment length approaches the 8192-byte boundary
Correlate iSCSI portal login failures with kernel ring buffer anomalies through centralized log analysis

Monitoring Recommendations

Forward dmesg and /var/log/kern.log from iSCSI target hosts to a centralized log store and alert on iscsi_target or slab corruption strings
Baseline expected initiator source addresses and flag connections from unknown IPs to portals exposing CHAP
Track iSCSI login rate and failure rate per initiator to surface enumeration or fuzzing behavior

How to Mitigate CVE-2026-90011

Immediate Actions Required

Apply the upstream kernel patch that allocates one extra byte for login->req_buf, referenced by commits 1624bff, 3ddf3ea, 5fac79f, 6b589ef, 6ddddca, b19dc17, eb9dadf, and f482592
Restrict network access to TCP port 3260 on iSCSI target hosts to trusted initiator subnets using host or perimeter firewalls
Audit LIO target configurations and disable CHAP on portals where it is not required, since the vulnerable path is only reachable with CHAP enabled

Patch Information

The fix reserves a terminator byte for the login payload by allocating MAX_KEY_VALUE_PAIRS + 1 bytes with kzalloc(). Because every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, the trailing byte remains zero and terminates the string. Patch details are published in the upstream stable tree: Kernel Git Commit 1624bff, Kernel Git Commit 3ddf3ea, Kernel Git Commit 5fac79f, Kernel Git Commit 6b589ef, Kernel Git Commit 6ddddca, Kernel Git Commit b19dc17, Kernel Git Commit eb9dadf, and Kernel Git Commit f482592.

Workarounds

Unload the iscsi_target_mod module on hosts that do not require iSCSI target services until the patched kernel is deployed
Where CHAP is not mandatory, remove CHAP configuration from LIO ACLs so the vulnerable code path is bypassed by iscsi_login_zero_tsih_s2()
Enforce IPsec or network segmentation between initiators and target portals to prevent untrusted hosts from reaching TCP 3260