{"id":"CVE-2026-98479","revision":"8c13ff901ad24c87a6a3a2c67fc5f457","records":[{"revision":"8c13ff901ad24c87a6a3a2c67fc5f457","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-98479","aliases":[],"title":"scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.","state":0,"publishedAt":"2026-10-18T15:15:53.663+00:00","modifiedAt":"2026-10-24T14:09:01.805+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/libiscsi_tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"79991b770fc3685b1d5cf805b659a879edd19931\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"8db1232945bc663fb94f300090a1fc108de99296\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"94e5bdd08e51c450d954bc592f591c233ca5c9df\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"de96dc11aee0d058927bff94a168e3c5c46483e2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"e3b25bf2cf2496e85bc05b33360faf9fdf880e03\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"ee56b5e18f566c0b5a183379dcd63d402cebf2f8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"24ffc919467d20951f0f132d1c75294e2e91e09b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a081c13e39b5c17052a7b46fafa61019c4c110ff\",\n                            \"lessThan\": \"bce07e2f37b5e4a427d36fd6b1c14067b27591db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/libiscsi_tcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.29\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.29\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931","https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296","https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df","https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2","https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03","https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8","https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b","https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98479","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98479","identifiers":["CVE-2026-98479"]},"retained":false,"historicalAffected":[]}],"coverage":[]}