CVE-2026-72084 Linux CVE debrief

Who should care

Linux kernel developers, SCSI target subsystem users, and administrators of systems using the Linux kernel should be aware of this vulnerability. They should verify and apply the kernel patch, restrict access to the SCSI target subsystem, and monitor for suspicious activity. Additionally, Linux distributions and vendors should review and test the patch to ensure it is effective and does not introduce new vulnerabilities. Users of Linux-based systems, especially those using iSCSI, should also be aware of the potential risks and take necessary precautions to protect their systems. This includes reviewing system logs for signs of exploitation and implementing compensating controls to mitigate the risk of exploitation. Security teams should prioritize patching and vulnerability management for Linux systems, and asset owners should review their inventory to ensure that all affected systems are identified and remediated. Furthermore, security teams should monitor for potential exploitation attempts and review system logs for signs of suspicious activity. Linux kernel developers should also review the code changes and test the patch to ensure it is effective and does not introduce new vulnerabilities. The Linux community should also be aware of this vulnerability and work together to develop and test the patch. Overall, a coordinated effort is required to address this vulnerability and prevent potential exploitation. Linux kernel users and administrators should also consider implementing additional security measures, such as access controls and intrusion detection systems, to further mitigate the risk of exploitation. By taking these steps, Linux kernel users and administrators can help prevent potential exploitation of this vulnerability and protect their systems from potential attacks. Linux kernel developers and security teams should also work together to develop and test patches for other potential vulnerabilities in the Linux kernel. This will help to ensure the long-term security and stability of Linux-based systems. Linux distributions and vendors should also prioritize patching and vulnerability management for Linux systems to ensure that all affected systems,

Technical summary

The Linux kernel's SCSI target subsystem has a vulnerability in the `target_parse_pr_out_transport_id` function. The function does not validate the length of the received buffer, leading to an out-of-bounds read when parsing an iSCSI TransportID. This can cause a kernel crash (KASAN: vmalloc-out-of-bounds in strstr). The vulnerability is reachable by any fabric that delivers a PR OUT to a device exported through an iSCSI TPG, including a guest via vhost-scsi. The issue arises from the function's inability to determine the valid byte count of the received buffer, allowing an initiator to submit a TransportID whose iSCSI name contains neither a ',i,0x' substring nor a NUL terminator. This fills the parameter list to its end, causing the scan to run off the end of the buffer. To address this, it is essential to pass the number of received bytes down to the parser and validate the iSCSI TransportID's own self-described length.

Defensive priority

High

Recommended defensive actions

• Verify and apply the kernel patch
• Restrict access to the SCSI target subsystem
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a missing length check in the `target_parse_pr_out_transport_id` function. The function handles the raw PERSISTENT RESERVE OUT parameter buffer without knowing the valid byte count. An initiator can submit a TransportID whose iSCSI name contains neither a ',i,0x' substring nor a NUL terminator, filling the parameter list to its end, causing the scan to run off the end of the buffer.

Official resources