CVE-2026-90414

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: reject PDUs declaring more data than was received

isert_recv_done() hands each received PDU to the opcode handlers without

ever looking at wc->byte_len, the number of bytes the HCA actually placed

in the receive descriptor. The handlers then copy that many bytes - the

data-segment length the initiator declared in the BHS

(ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) -

out of the fixed-size descriptor:

isert_handle_iscsi_dataout():

sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),

unsol_data_len);

isert_handle_scsi_cmd():

sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,

isert_get_data(rx_desc), imm_data_len);

Because the declared length is never checked against wc->byte_len, an

initiator can declare a data segment larger than the bytes it actually

sent (and larger than the descriptor) and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References