CVE-2026-90307

A flaw was found in the Linux kernel. A remote attacker could exploit a vulnerability in the SCSI Remote Protocol (SRP) implementation by sending a specially crafted, truncated credential request. This malformed request causes an out-of-bounds read, leading to a heap information leak of up to 8 bytes per response. This could allow the attacker to obtain sensitive information from kernel memory.

An out-of-bounds heap read in the RDMA/SRP initiator path can occur when srp_process_cred_req or srp_process_aer_req parses a truncated SRP_CRED_REQ or SRP_AER_REQ without verifying the received byte_len. A malicious or compromised SRP target can advertise a very small max_ti_iu_len and send an 8 byte SRP_CRED_REQ, causing the initiator to read req tag beyond the receive buffer and copy leaked heap bytes into the SRP_CRED_RSP sent back to the target. SRP_AER_REQ has a similar issue and can also read req lun from an insufficient buffer. For the CVSS the PR:N because the attacker only needs to control or compromise an SRP target reachable by the initiator and does not need local privileges on the initiator. The issue is adjacent network reachable in typical RDMA/SRP storage fabrics rather than broadly Internet reachable. Impact is information disclosure from kernel heap memory. No write primitive or direct privilege escalation path is shown by the code context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.