CVE-2026-90294

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: delay the final Login Response until the session is registered

isert_put_login_tx() puts the final Login Response on the wire before

__transport_register_session(), which iscsi_post_login_handler() reaches

only after iscsi_target_do_login() returns. An initiator that issues a

SCSI command as soon as it sees that response can have it executed against

an se_session whose se_tpg is still NULL, and the ib-comp-wq worker oopses

on the NULL dereference.

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]

CPU: 0 UID: 0 PID: 178 Comm: kworker/0:1H Not tainted 7.2.0-rc5-V2CTL-gf5098b6bae76 #10 PREEMPT(lazy)

Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

Workqueue: ib-comp-wq ib_cq_poll_work

RIP: 0010:target_sub

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References