CVE-2026-74556

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer<br /> <br /> iscsi_tcp_hdr_dissect() receives the data segment of several PDU types<br /> into the fixed-size conn-&gt;data buffer, which is allocated for<br /> ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,<br /> REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU<br /> whose DataSegmentLength exceeds that buffer.<br /> <br /> The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its<br /> data segment (sense/response data) into conn-&gt;data via<br /> iscsi_tcp_data_recv_prep(), but it does so without the same check. The<br /> only upstream bound on in.datalen is conn-&gt;max_recv_dlength, the<br /> initiator&amp;#39;s advertised MaxRecvDataSegmentLength, which is commonly<br /> negotiated well above 8192 (open-iscsi defaults to 262144). A target<br /> that returns a SCSI Response with a DataSegmentLength between 8193 and<br /> max_recv_dlength therefore overflows the 8192-byte conn-&gt;data buffer.<br /> <br /> Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly<br /> like those responses: bound the data segment, receive it into conn-&gt;data<br /> when present, and otherwise complete the PDU with no data. Fold the<br /> opcode into that case group rather than duplicating the check.