CVE-2026-98479

A flaw was found in the Linux kernel's iSCSI TCP subsystem. A malicious or compromised iSCSI storage server can cause memory corruption and data integrity loss on a connected client by sending an unexpected Data-In Protocol Data Unit (PDU) in response to a write command. Because the kernel fails to verify the expected data transfer direction before copying the payload into memory, target-supplied data overwrites the initiator's local buffers or file system cache pages.

This vulnerability is rated as having Moderate impact on Red Hat Enterprise Linux and OpenShift environments because exploitation requires an established session with an untrusted or compromised iSCSI target. In typical enterprise deployments, iSCSI initiator traffic is constrained to dedicated storage networks with controlled target infrastructure, substantially limiting an external attacker's ability to inject illegitimate network frames. While an adversarial storage provider can cause local page corruption on connected hosts during write operations, systems not configured as software iSCSI clients or environments using hardware-offloaded SAN adapters remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.