Critical Vulnerability: CVE-2026-99153

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU

A Reject PDU carries a copy of the header it rejects, and

iscsi_handle_reject() takes the ITT out of that copy to find the task to

clean up:

memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));

...

task = iscsi_itt_to_task(conn, rejected_pdu.itt);

That value is whatever the target put there. iscsi_itt_to_task() bounds

the index against cmds_max and checks nothing else, so any task in the

pool can be named, and iscsi_nop_out_rsp() then completes it.

An index that has never been used gives a NULL task->conn: the pool is

zeroed at session setup and conn is assigned only when a task is

allocated. If the task was used and returned, iscsi_complete_task() hits

its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount

underflows. An in-flight SCSI command is completed as successful - a 1

MiB read returned 1048576 with none of its buffer

CVE-2026-99153 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

EPSS (Exploit Prediction): 0.2% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-99153 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.