CVE-2026-90414 Linux CVE debrief

Who should care

Linux kernel developers and administrators, iSER target and initiator operators, and security teams responsible for Linux kernel and iSER infrastructure should verify and apply the patch, restrict initiator access, and monitor for unusual activity. They should also review and update iSER configuration to ensure proper receive buffer sizing and implement compensating controls to detect and prevent exploitation.

Why it matters

This vulnerability allows an initiator to declare a data segment larger than the bytes it actually sent, causing an out-of-bounds read of the receive buffer. Linux kernel developers and administrators, iSER target and initiator operators, and security teams should verify and apply the patch, restrict initiator access, and monitor for unusual activity.

• Verify receive buffer sizing and PDU length validation
• Restrict initiator access to the iSER target
• Monitor for unusual PDU lengths and connection reinitialization

Technical summary

The Linux kernel's iSER implementation does not validate the declared data segment length against the actual received bytes, allowing an initiator to cause an out-of-bounds read of the receive buffer. This can lead to heap contents being written through the backend to the backing store. The vulnerability is triggered after login completes when an initiator sends a PDU with a declared data-segment length exceeding what was received. To address this, validate wc->byte_len against the framing in isert_recv_done() before the PDU reaches any handler, and reinstate the connection if it is short.

Defensive priority

High

Recommended defensive actions

• Verify and apply the Linux kernel patch to validate wc->byte_len against the framing in isert_recv_done()
• Restrict initiator access to the iSER target
• Monitor for unusual PDU lengths and connection reinitialization
• Review and update iSER configuration to ensure proper receive buffer sizing
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls to detect and prevent exploitation
• Track and review security logs for signs of exploitation attempts

Evidence notes

The vulnerability was resolved in the Linux kernel by validating wc->byte_len against the framing in isert_recv_done() before the PDU reaches any handler, and reinstating the connection if it is short.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.