{"id":"CVE-2026-98479","title":"scsi: libiscsi_tcp: Check the data direction of a Data-In PDU","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segmen…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 79991b770fc3685b1d5cf805b659a879edd19931","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 8db1232945bc663fb94f300090a1fc108de99296","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 94e5bdd08e51c450d954bc592f591c233ca5c9df","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < de96dc11aee0d058927bff94a168e3c5c46483e2","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < e3b25bf2cf2496e85bc05b33360faf9fdf880e03","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < ee56b5e18f566c0b5a183379dcd63d402cebf2f8","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 24ffc919467d20951f0f132d1c75294e2e91e09b","Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < bce07e2f37b5e4a427d36fd6b1c14067b27591db","Linux 2.6.29"],"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:20:16.790Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98479","references":[{"url":"https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931"},{"url":"https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296"},{"url":"https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df"},{"url":"https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2"},{"url":"https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03"},{"url":"https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8"},{"url":"https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b"},{"url":"https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.295Z","slug":"CVE-2026-98479","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.\n\n## Affected\n\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 79991b770fc3685b1d5cf805b659a879edd19931`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 8db1232945bc663fb94f300090a1fc108de99296`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 94e5bdd08e51c450d954bc592f591c233ca5c9df`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < de96dc11aee0d058927bff94a168e3c5c46483e2`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < e3b25bf2cf2496e85bc05b33360faf9fdf880e03`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < ee56b5e18f566c0b5a183379dcd63d402cebf2f8`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < 24ffc919467d20951f0f132d1c75294e2e91e09b`\n- `Linux >= a081c13e39b5c17052a7b46fafa61019c4c110ff < bce07e2f37b5e4a427d36fd6b1c14067b27591db`\n- `Linux 2.6.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}