CVE-2026-74556

Critical

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

Package Linux Kernel
Published 2026-08-15
Last modified 2026-08-19
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

9.8

out of 10
Critical
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 2.6.29 and later are affected. Fixed in 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2 and their respective stable series.

Affected from
≥ 2.6.29
Fixed in
✓ 5.10.265 5.10.x ✓ 5.15.216 5.15.x ✓ 6.1.183 6.1.x ✓ 6.6.151 6.6.x ✓ 6.12.103 6.12.x ✓ 6.18.44 6.18.x ✓ 7.1.8 7.1.x ✓ 7.2

References

8 total
Showing 5 of 8 references View all on NVD

Frequently asked questions

  • What is CVE-2026-74556?

    CVE-2026-74556 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . It affects Linux kernel versions from 2.6.29 onward and has been patched in 5.10.265, 5.15.216, 6.1.183 and others. CVE-2026-74556 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-74556?

    CVE-2026-74556 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H .

  • Is there a patch available for CVE-2026-74556?

    Yes. CVE-2026-74556 has been patched. Fixed versions include 5.10.265, 5.15.216, 6.1.183 and others. If you are running Linux kernel 2.6.29 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-74556 actively exploited?

    No. CVE-2026-74556 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST