CVE-2026-98479: Linux Vulnerability (CVSS 7.5)

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.18%

6.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= a081c13e39b5c17052a7b46fafa61019c4c110ff, < 79991b770fc3685b1d5cf805b659a879edd19931; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < 8db1232945bc663fb94f300090a1fc108de99296; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < 94e5bdd08e51c450d954bc592f591c233ca5c9df; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < de96dc11aee0d058927bff94a168e3c5c46483e2; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < e3b25bf2cf2496e85bc05b33360faf9fdf880e03; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < ee56b5e18f566c0b5a183379dcd63d402cebf2f8; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < 24ffc919467d20951f0f132d1c75294e2e91e09b; >= a081c13e39b5c17052a7b46fafa61019c4c110ff, < bce07e2f37b5e4a427d36fd6b1c14067b27591db
Linux	Linux	2.6.29

References

Timeline

Published: Oct 18, 2026
Last Modified: Oct 24, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-98479?

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does.

How severe is CVE-2026-98479?

CVE-2026-98479 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.

How do I fix CVE-2026-98479?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →