CVE-2026-98479

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task

and copies the PDU's data segment into that command's scatterlist without

asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same

file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.

A target that answers a WRITE command's ITT with a Data-In therefore has

the initiator write target-supplied bytes into the pages that write was

about to send. Those are the caller's own pinned pages for an O_DIRECT

write, and page cache pages for a buffered one.

Observed against a test target that emits one 512-byte Data-In naming a 128

KB write's ITT, after the R2T for that write. With O_DIRECT the caller's

buffer ends up holding 512 bytes of the target's data while pwrite()

returns 131072. Buffered is quieter: pwrite() and fsync() both succeed,

nothing is logged,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References