CVE-2026-80691

A flaw was found in the Linux kernel's SCSI target iblock module. A missing null pointer check in the iblock_execute_pr_out() function, specifically for the ops->pr_clear callback during PREEMPT and RELEASE operations, allows unimplemented hooks to be called. This can lead to dereferencing a null function pointer, potentially causing a system crash and resulting in a denial of service.

A NULL function pointer dereference in the SCSI target iblock PR OUT path can occur because iblock_execute_pr_out checks ops pr_clear while later calling ops pr_preempt or ops pr_release. A remote storage initiator can trigger the path by sending PREEMPT, PREEMPT_AND_ABORT, or RELEASE persistent reservation commands to an exported iblock backed LUN when the underlying block device does not implement the matching callback. For the CVSS the PR:N is used for the paranoid case because a remote initiator may trigger the path with only access to an exported target endpoint, although many deployments restrict this with ACLs or authentication. The issue is network reachable when the target is exposed through iSCSI or another SCSI fabric. Impact is denial of service via kernel crash. No clear information disclosure or privilege escalation primitive is shown by the code change because the observed primitive is a NULL callback dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.