CVE-2026-72084

A flaw was found in the Linux kernel's SCSI target subsystem. An attacker, by submitting a specially crafted iSCSI TransportID during a PERSISTENT RESERVE OUT operation, could cause an out-of-bounds read. This vulnerability, which occurs due to unbounded parsing of the TransportID, can lead to a system crash, resulting in a Denial of Service (DoS). This can be exploited by a remote attacker or a guest in a virtualized environment.

An out-of-bounds read in the SCSI target PR OUT TransportID parser can occur because the iSCSI TransportID parser processes attacker-controlled descriptor data without knowing the number of bytes actually received. For FORMAT CODE 01b, iscsi_parse_pr_out_transport_id() previously used an unbounded strstr() to locate the ",i,0x" separator between the iSCSI initiator name and ISID. A malformed TransportID containing neither the expected separator nor a NUL terminator can therefore cause the search to continue beyond the end of the PR OUT parameter buffer. Additional unbounded string handling on error and insufficient validation of the descriptor's self-reported length can extend the same out-of-bounds access condition.

When the PR OUT parameter list spans multiple pages, transport_kmap_data_sg() can map the buffer as a multi-page vmap. An unbounded scan beyond the supplied data may then reach the trailing vmalloc guard page, resulting in a kernel page fault and oops. The demonstrated impact is therefore a kernel crash and denial of service.

The affected parser is reachable through fabrics that can deliver a crafted PR OUT request to a device exported through an iSCSI target portal group (TPG). The same target-core path can also be exposed across virtualization boundaries, including guest-to-host configurations using vhost-scsi. Consequently, exploitation does not necessarily require local code execution or privileges on the affected host. For a network-exposed iSCSI target, a remote initiator capable of reaching the exported storage can potentially supply the malformed TransportID directly. In practice, exposure is commonly restricted to storage, virtualization, or otherwise trusted internal networks, which substantially limits the attack surface compared with a generally exposed network service.

The directly demonstrated security impact is availability loss (A:H) through a host kernel crash. No attacker-visible information disclosure, controlled out-of-bounds write, privilege escalation, or arbitrary code execution has been demonstrated. However, because the vulnerable code performs unbounded parsing of attacker-controlled data and subsequently operates on pointers derived from that parsing, additional memory-safety impact cannot be completely excluded and can be considered in a paranoid assessment or manual review.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module iscsi_target_mod from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.