SECUFOCUSNOW
Home›CVE index›CVE-2026-74556
ReviewCritical

CVE-2026-74556

Linux

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_t...

CVSS
9.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.15
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_t...

Affected product and versions

Product
Linux
Affected versions
>= a081c13e39b5c17052a7b46fafa61019c4c110ff < a51812842084fd390590ab8dc0431f10c73ddc56, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < a8f94cc9f0e5759252551be3a172960c57f21f54, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < f1a3a51fc5dba0e99532379665069f1700da6b44, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < c97b5265cc47775f77fd2a23d6bde0426997b233, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 084af0253673425ce2ae62e3c7f74f0dd023711b, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 72815741715bd41556dac5eeb068bf0f8af06ee7, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676, >= a081c13e39b5c17052a7b46fafa61019c4c110ff < c1dea15f819cded9b3faf58f8bec72323568b6e6, >= 2.6.29
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available