CVE-2026-99154: Out-of-Bounds in Linux iSCSI Driver

CVE-2026-99154 describes an out-of-bounds read vulnerability in the Linux kernel libiscsi component that handles iSCSI protocol. A negative index derived from a PDU (Protocol Data Unit) is not validated in the parse_pdu_itt and iscsi_verify_itt functions, allowing memory reads before the session->cmds[] array. be2iscsi and beiscsi iSCSI drivers are vulnerable because they assign the ITT (Initiator Task Tag) received from the target without validation. A remote transport can send a negative ITT value via an unsolicited NOP-In, causing unauthorized memory reads.

Severity is declared Critical with CVSS 9.8 from NVD. The data was published on October 28, 2026, making it recent. On X, 3 posts were recorded in the last 24 hours with 9 total interactions, indicating attention from the Linux community but not widespread distribution. Posts coherently cite the same vulnerability, CVSS score, and affected component. No verified public exploits are reported in known repositories. The status of the official patch is not confirmed in the data.

System administrators running Linux systems with be2iscsi (Emulex/Broadcom) or beiscsi iSCSI drivers must urgently verify the kernel version in use and consult the official vendor advisories for patch availability. In the absence of an available patch, restrict access to untrusted iSCSI targets and monitor kernel logs for iSCSI-related errors. Once the patch is available, apply it with priority to all affected systems, particularly those storage and network infrastructure that depend on iSCSI.