Към съдържанието
Търсене

CVE-2026-74556: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

Засегнати продукти

  • Linux Linux: a081c13e39b5c17052a7b46fafa61019c4c110ff преди a51812842084fd390590ab8dc0431f10c73ddc56; a081c13e39b5c17052a7b46fafa61019c4c110ff преди a8f94cc9f0e5759252551be3a172960c57f21f54; a081c13e39b5c17052a7b46fafa61019c4c110ff преди f1a3a51fc5dba0e99532379665069f1700da6b44; a081c13e39b5c17052a7b46fafa61019c4c110ff преди c97b5265cc47775f77fd2a23d6bde0426997b233; a081c13e39b5c17052a7b46fafa61019c4c110ff преди 084af0253673425ce2ae62e3c7f74f0dd023711b; a081c13e39b5c17052a7b46fafa61019c4c110ff преди 72815741715bd41556dac5eeb068bf0f8af06ee7; a081c13e39b5c17052a7b46fafa61019c4c110ff преди b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676; a081c13e39b5c17052a7b46fafa61019c4c110ff преди c1dea15f819cded9b3faf58f8bec72323568b6e6
  • Linux Linux: 2.6.29; преди 2.6.29; 5.10.265 до 5.10.*; 5.15.216 до 5.15.*; 6.1.183 до 6.1.*; 6.6.151 до 6.6.*; 6.12.103 до 6.12.*; 6.18.44 до 6.18.*; 7.1.8 до 7.1.*; от 7.2 нататък

История

  • 15 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74556: Linux | freedomonline.bg