CVE-2026-90413

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: reject login PDUs declaring more data than was received

isert_login_recv_done() records how many bytes the HCA actually placed in

the login buffer, but nothing compares that against the length the login

PDU's BHS declares. isert_rx_login_req() copies min(login_req_len,

MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then

reads the declared length back out of that buffer - for the first PDU in

iscsi_target_locate_portal(),

payload_length = ntoh24(login_req->dlength);

tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL);

and for the ones after it in iscsi_decode_text_input(), reached from

iscsi_target_do_login().

login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so

an initiator that declares more than it sends reads off the end of it,

before authentication and with the length under its control:

BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References