{"id":"CVE-2026-98479","summary":"scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.","modified":"2026-10-20T02:30:29.419006320Z","published":"2026-10-18T15:15:53.663Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98479.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296"},{"type":"WEB","url":"https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db"},{"type":"WEB","url":"https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98479.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98479"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a081c13e39b5c17052a7b46fafa61019c4c110ff"},{"fixed":"79991b770fc3685b1d5cf805b659a879edd19931"},{"fixed":"8db1232945bc663fb94f300090a1fc108de99296"},{"fixed":"94e5bdd08e51c450d954bc592f591c233ca5c9df"},{"fixed":"de96dc11aee0d058927bff94a168e3c5c46483e2"},{"fixed":"e3b25bf2cf2496e85bc05b33360faf9fdf880e03"},{"fixed":"ee56b5e18f566c0b5a183379dcd63d402cebf2f8"},{"fixed":"24ffc919467d20951f0f132d1c75294e2e91e09b"},{"fixed":"bce07e2f37b5e4a427d36fd6b1c14067b27591db"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98479.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.29"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.112"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.55"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98479.json"}}],"schema_version":"1.9.0"}