CVE-2026-99152

A flaw was found in the Linux kernel's SCSI iSCSI implementation (libiscsi). A remote, connected iSCSI target can cause a Denial of Service (DoS) by sending a crafted management response that references an uninitialized or free task slot. Because the kernel fails to verify that the task is active before attempting to process its connection details, this action leads to a null-pointer dereference and crashes the operating system.

This vulnerability is rated as Important because a rogue or compromised remote storage server can trigger an unhandled kernel panic and crash the host system over the network without requiring local privileges. The affected SCSI layer is only active on systems configured as iSCSI initiators with established connections to iSCSI targets. Environments that do not utilize network-attached iSCSI storage or that isolate storage traffic across dedicated, authenticated private networks are not exposed to untrusted endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.