CVE-2026-74557

A flaw was found in the Linux kernel's libiscsi component. An incorrect bounds check in the iscsi_scsi_cmd_rsp() function allows a malicious iSCSI target to craft a SCSI Response. This can lead to a read beyond the intended buffer, causing stale connection data to be copied into the SCSI sense buffer and subsequently returned to userspace, potentially disclosing sensitive information.

iscsi_scsi_cmd_rsp() can copy stale data into the SCSI sense buffer because the bounds check accounts for senselen but not for the 2 byte sense length prefix before the sense bytes. A malicious or compromised iSCSI target can return a crafted SCSI Response where datalen equals senselen, causing memcpy from data plus 2 to read up to two bytes past the received segment and expose stale conn data to userspace through the command sense buffer. For the CVSS the PR:N is used for the paranoid score because the attacker does not need local privileges on the initiator and only needs the ability to send target responses over an established iSCSI storage connection. The issue is network reachable in environments where the initiator connects to an attacker controlled or compromised target. Impact is an information leak only with C:L and I:N/A:N. iSCSI is typically deployed inside isolated storage or data center networks and is usually not exposed to the public Internet.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.