CVE-2026-90413

A flaw was found in the Linux kernel's IB/isert component. A remote attacker can exploit this vulnerability by sending a specially crafted login Protocol Data Unit (PDU) that declares a larger data segment length than the actual data received. This discrepancy causes an out-of-bounds read during memory allocation, leading to a system crash and resulting in a Denial of Service (DoS).

An out of bounds read exists in the iSER target login path because the login PDU DataSegmentLength can be larger than the number of bytes actually received into the login buffer. A remote initiator on the RDMA storage fabric can trigger this before authentication by declaring a larger login payload than it sends, causing kmemdup_nul to read past the fixed MAX_KEY_VALUE_PAIRS login request buffer. For the CVSS the PR:N value is selected because the malformed login PDU is processed before authentication and no local user context on the target is required beyond reachability to the iSER target. The issue is network reachable on systems that expose an iSER target, but practical exposure is usually limited to isolated storage or data center networks rather than the public Internet. Impact is at least denial of service via kernel crash or sanitizer detected OOB read. In the paranoid score, limited confidentiality and integrity impact are kept because attacker controlled over read length may copy adjacent kernel heap bytes into login parsing state, but the patch does not show an OOB write or UAF primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.