CVE-2026-98479
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
La rama Data-In de iscsi_tcp_hdr_dissect() resuelve el ITT a una tarea y copia el segmento de datos del PDU en la scatterlist de ese comando sin comprobar si el comando estaba leyendo. iscsi_tcp_r2t_rsp() en el mismo archivo sí lo comprueba y rechaza un R2T para un comando que no es DMA_TO_DEVICE.
Un destino que responde al ITT de un comando WRITE con un Data-In hace, por tanto, que el iniciador escriba bytes suministrados por el destino en las páginas que esa escritura iba a enviar.
Leer descripción completaMostrar menos
Se trata de las páginas ancladas propias del llamador en el caso de una escritura O_DIRECT, y de las páginas de la caché de páginas en el caso de una escritura con búfer.
Observado frente a un destino de prueba que emite un Data-In de 512 bytes que nombra el ITT de una escritura de 128 KB, tras el R2T de esa escritura. Con O_DIRECT, el búfer del llamador termina conteniendo 512 bytes de los datos del destino mientras pwrite() devuelve 131072. La escritura con búfer es más silenciosa: pwrite() y fsync() tienen éxito, no se registra nada, y al leer después esos bloques se obtienen los bytes del destino desde la caché de páginas sin que haya ningún comando en la red.
Comprueba la dirección antes de usar la scatterlist, como ya hace la ruta de R2T.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.18 %
- Percentil entre todas las CVEs puntuadas
- 7
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b
- https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931
- https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296
- https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df
- https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db
- https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2
- https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03
- https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98479",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "79991b770fc3685b1d5cf805b659a879edd19931",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "8db1232945bc663fb94f300090a1fc108de99296",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "94e5bdd08e51c450d954bc592f591c233ca5c9df",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "de96dc11aee0d058927bff94a168e3c5c46483e2",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "e3b25bf2cf2496e85bc05b33360faf9fdf880e03",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "ee56b5e18f566c0b5a183379dcd63d402cebf2f8",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "24ffc919467d20951f0f132d1c75294e2e91e09b",
"versionType": "git"
},
{
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"lessThan": "bce07e2f37b5e4a427d36fd6b1c14067b27591db",
"versionType": "git"
}
],
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.29",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:58.467",
"references": [
{
"url": "https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does."
}
],
"lastModified": "2026-10-19T10:18:58.960",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}