{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90293 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90293 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90293 and fix it if it is affected.\n\nWhat it is: CVE-2026-90293 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90293 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90293/ (Markdown: https://insights.sbomify.com/CVE-2026-90293/index.md)","id":"CVE-2026-90293","markdown":"https://insights.sbomify.com/CVE-2026-90293/index.md","name":"CVE-2026-90293","record":{"aliases":["AZL-101996","BELL-CVE-2026-90293","DEBIAN-CVE-2026-90293","GHSA-3h9w-c8jj-3x6p","UBUNTU-CVE-2026-90293"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel iSER","requires_auth":"none","summary":"A race condition in the Linux kernel iSER driver allows a null pointer dereference, causing a system crash when an initiator sends data prematurely.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: post the full-feature receive buffers after session registration\n\nisert_put_login_tx() posts the full-feature receive buffers before\n__transport_register_session() runs, so an initiator that does not wait\nfor the final Login Response can still have a SCSI command executed\nagainst an se_session whose se_tpg is NULL - the same oops as the\nprevious patch, at target_submit+0xbe.\n\nPost them from isert_get_rx_pdu(), which the previous patch already uses\nto send that response, and post them before that send: the receive queue\nis filled at the moment the initiator is told it may use it.  Allocating\nthere keeps the existing property that a memory allocation failure cannot\nhappen once the final Login Response is on the wire.\n\nThe receive queue is already empty between the final Login Request and\nisert_post_recvm(); this moves the second point later, from a median of\n92 us to 172 us over 1200 logins.  Only an initiator that sends before it\nhas been told to can reach that window, and on IB and RoCE its send is\nretried there until the buffers appear - isert_rdma_accept() asks for\nrnr_retry_count = 7.  iWARP has no RNR flow control, so there the same\nsend terminates the connection instead.\n\nMeasured over rxe, 400 login cycles per run, with an initiator that does\nnot wait: an instrumented build counted no entries to isert_recv_done()\nbefore the buffers are posted in 10 runs, where that initiator oopsed\n8 of 10 unpatched runs and 5 of 10 with only the previous patch.\n\nNot tested: iWARP, discovery sessions over iSER, and real HCAs.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"IB/isert: post the full-feature receive buffers after session registration","id":"CVE-2026-90293","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"IB/isert: delay the final Login Response until the session is registered","id":"CVE-2026-90294"},"packages":[],"prev":{"headline":"RDMA/siw: Fix use-after-free in siw_accept()","id":"CVE-2026-90292"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel iSER driver allows a null pointer dereference, causing a system crash when an initiator sends data prematurely.","url":"https://insights.sbomify.com/CVE-2026-90293/"}