CVE-2026-99153: ITT validation in libiscsi Reject PDU

CVE-2026-99153 is a validation flaw in the Linux Kernel libiscsi module affecting Reject PDU (Protocol Data Unit) handling in the iSCSI protocol. The vulnerability lies in iscsi_handle_reject(), which extracts the ITT (Initiator Task Tag) from a Reject PDU without proper validation. A hostile iSCSI target can send an arbitrary ITT, allowing the kernel to complete unexecuted SCSI commands as successful, causing critical data loss in storage and virtualization environments.

With a CVSS of 9.8 (critical severity), this flaw represents an immediate and critical risk. The official technical description documents real impact: a 1 MiB read is confirmed as completed and returned to the client without the buffer being actually written, causing corrupted production data. Additionally, kernel panic with general protection fault is observed. The patch is available starting from Linux kernel 5.10.273, confirmed by public signals from 31 October 2026.

Administrators must give absolute priority to updating the Linux kernel to version 5.10.273 or later, especially on systems using iSCSI for storage, SAN, or virtualization. As a temporary measure, disable non-critical iSCSI and isolate it in separate VLANs from untrusted targets. Monitor kernel log for general protection fault, iscsi process crashes, or commands completed with data inconsistencies. Verify data integrity on iSCSI reads until patching is complete.