# CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration

> A race condition in the Linux kernel iSER driver allows a null pointer dereference, causing a system crash when an initiator sends data prematurely.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-101996, BELL-CVE-2026-90293, DEBIAN-CVE-2026-90293, GHSA-3h9w-c8jj-3x6p, UBUNTU-CVE-2026-90293

## What is CVE-2026-90293?

CVE-2026-90293 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: post the full-feature receive buffers after session registration

isert_put_login_tx() posts the full-feature receive buffers before
__transport_register_session() runs, so an initiator that does not wait
for the final Login Response can still have a SCSI command executed
against an se_session whose se_tpg is NULL - the same oops as the
previous patch, at target_submit+0xbe.

Post them from isert_get_rx_pdu(), which the previous patch already uses
to send that response, and post them before that send: the receive queue
is filled at the moment the initiator is told it may use it.  Allocating
there keeps the existing property that a memory allocation failure cannot
happen once the final Login Response is on the wire.

The receive queue is already empty between the final Login Request and
isert_post_recvm(); this moves the second point later, from a median of
92 us to 172 us over 1200 logins.  Only an initiator that sends before it
has been told to can reach that window, and on IB and RoCE its send is
retried there until the buffers appear - isert_rdma_accept() asks for
rnr_retry_count = 7.  iWARP has no RNR flow control, so there the same
send terminates the connection instead.

Measured over rxe, 400 login cycles per run, with an initiator that does
not wait: an instrumented build counted no entries to isert_recv_done()
before the buffers are posted in 10 runs, where that initiator oopsed
8 of 10 unpatched runs and 5 of 10 with only the previous patch.

Not tested: iWARP, discovery sessions over iSER, and real HCAs.

## Which versions are affected by CVE-2026-90293?


## How do I fix CVE-2026-90293?

Apply the vendor's patch.

## Is CVE-2026-90293 being exploited?

There is no known exploitation of CVE-2026-90293 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-90293 and fix it if it is affected.

What it is: CVE-2026-90293 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-90293 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-90293/ (Markdown: https://insights.sbomify.com/CVE-2026-90293/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-90293
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90293
- OSV: https://osv.dev/vulnerability/CVE-2026-90293

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-90293/
Summaries are generated and may contain mistakes; the official description above is the record.