CVE-2026-74556

A flaw was found in the Linux kernel's libiscsi_tcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentially causing memory corruption within the kernel.

This vulnerability is rated as Important because successful exploitation allows a rogue or compromised storage target to trigger a kernel-level heap buffer overflow over the network, which could result in a system crash or arbitrary code execution with kernel privileges. In typical Red Hat Enterprise Linux installations, the affected iSCSI transport driver is not utilized by default unless the host is explicitly configured as an initiator connected to an external iSCSI target. The blast radius is therefore restricted to systems communicating with untrusted or compromised SAN infrastructure, preventing unauthenticated remote exposure from arbitrary endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If iSCSI initiator functionality is not required, prevent the libiscsi_tcp kernel module from loading by blacklisting it. Create a file such as /etc/modprobe.d/blacklist-iscsi.conf with the content blacklist libiscsi_tcp. A system reboot is required for this change to take effect. This may impact systems relying on iSCSI storage.