CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
target-supplied data segment.  The segment carries a 2-byte sense length
followed by the sense bytes, so it must hold 2 + senselen bytes, but the
bounds check only requires datalen >= senselen:

	senselen = get_unaligned_be16(data);
	if (datalen < senselen)
		goto invalid_datalen;
	memcpy(sc->sense_buffer, data + 2,
	       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));

A target that returns a SCSI Response whose datalen equals senselen
(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +
2 read up to two bytes past the received data.  Those bytes are stale
conn->data contents and end up in the command's sense buffer, which is
returned to userspace.

Account for the 2-byte sense length prefix in the check.

The Linux kernel CVE team has assigned CVE-2026-74557 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.18 with commit 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 and fixed in 6.6.151 with commit 7567f06abdefb1caf2d836107c4d08c5185c650e
	Issue introduced in 2.6.18 with commit 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 and fixed in 6.12.103 with commit 60499924faf4ef97e84228c20515218ef121facf
	Issue introduced in 2.6.18 with commit 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 and fixed in 6.18.44 with commit 3ef209ca0b4b68c75e9a814d90cc916026b5a6ac
	Issue introduced in 2.6.18 with commit 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 and fixed in 7.1.8 with commit 1f07a897d43c63e6c9458bf77450defef39b5833
	Issue introduced in 2.6.18 with commit 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 and fixed in 7.2-rc6 with commit 98b87885de4b7f605533a2860685f5689fce8e82

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74557
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/libiscsi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e
	https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf
	https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac
	https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833
	https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82