{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74557 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74557 is a high-severity vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74557 and fix it if it is affected.\n\nWhat it is: CVE-2026-74557 is a high-severity vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74557 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74557/ (Markdown: https://insights.sbomify.com/CVE-2026-74557/index.md)","id":"CVE-2026-74557","markdown":"https://insights.sbomify.com/CVE-2026-74557/index.md","name":"CVE-2026-74557","record":{"aliases":["AZL-96333","BELL-CVE-2026-74557","DEBIAN-CVE-2026-74557","GHSA-x575-q9wv-7p43","UBUNTU-CVE-2026-74557"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel iSCSI","requires_auth":"none","summary":"A malicious iSCSI target can leak stale kernel memory into the SCSI sense buffer, exposing sensitive data to userspace.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment.  The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data.  Those bytes are stale\nconn-\u003edata contents and end up in the command's sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer","id":"CVE-2026-74557","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"xsk: reclaim invalid Tx descriptors in ZC batch path","id":"CVE-2026-74558"},"packages":[],"prev":{"headline":"scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer","id":"CVE-2026-74556"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A malicious iSCSI target can leak stale kernel memory into the SCSI sense buffer, exposing sensitive data to userspace.","url":"https://insights.sbomify.com/CVE-2026-74557/"}