{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90414 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90414 is a critical memory corruption vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90414 and fix it if it is affected.\n\nWhat it is: CVE-2026-90414 is a critical memory corruption vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90414 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90414/ (Markdown: https://insights.sbomify.com/CVE-2026-90414/index.md)","id":"CVE-2026-90414","markdown":"https://insights.sbomify.com/CVE-2026-90414/index.md","name":"CVE-2026-90414","record":{"aliases":["AZL-101966","BELL-CVE-2026-90414","DEBIAN-CVE-2026-90414","GHSA-78ww-6hfv-8292","UBUNTU-CVE-2026-90414"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel iSER","requires_auth":"none","summary":"A remote attacker can trigger an out-of-bounds read in the Linux kernel iSER driver by declaring oversized data segments, potentially causing information disclosure or crashes.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: reject PDUs declaring more data than was received\n\nisert_recv_done() hands each received PDU to the opcode handlers without\never looking at wc-\u003ebyte_len, the number of bytes the HCA actually placed\nin the receive descriptor. The handlers then copy that many bytes - the\ndata-segment length the initiator declared in the BHS\n(ntoh24(hdr-\u003edlength), via the derived unsol_data_len / imm_data_len) -\nout of the fixed-size descriptor:\n\n  isert_handle_iscsi_dataout():\n        sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),\n                            unsol_data_len);\n  isert_handle_scsi_cmd():\n        sg_copy_from_buffer(cmd-\u003ese_cmd.t_data_sg, sg_nents,\n                            isert_get_data(rx_desc), imm_data_len);\n\nBecause the declared length is never checked against wc-\u003ebyte_len, an\ninitiator can declare a data segment larger than the bytes it actually\nsent (and larger than the descriptor) and cause an out-of-bounds read of\nthe receive buffer.\n\nNothing upstream of isert closes this door:\n\n  - __iscsit_check_dataout_hdr() bounds the inbound payload against\n    conn_ops-\u003eMaxXmitDataSegmentLength (MXDSL) - a transmit parameter,\n    used here for the inbound check.\n  - iscsi_set_connection_parameters() sets\n    ops-\u003eMaxXmitDataSegmentLength = ops-\u003eTargetRecvDataSegmentLength;\n    and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in\n    iscsi_check_acceptor_state(), so the value the initiator declares is\n    adopted verbatim (type range 512..16777215). The initiator effectively\n    raises its own ceiling.\n  - isert never clamps the negotiated value to its own fixed receive\n    descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and\n    the descriptor size are unrelated.\n\nThe imm_data_len == data_len path is more than an over-read: it aliases\nthe receive descriptor via sg_set_buf() and passes it to the backend as\nthe data source for the SCSI WRITE, so an over-declared length causes heap\ncontents past the descriptor to be written through the backend to the\nbacking store. The backend is the victim of the oversized scatterlist\nisert hands it, not the cause; no read-back of the written bytes was\ndemonstrated.\n\nTrigger: after login completes (full feature phase), an initiator that has\ndeclared a large TargetRecvDataSegmentLength and a FirstBurstLength that\npermits unsolicited/immediate data sends a PDU whose declared data-segment\nlength exceeds what was received. With KASAN:\n\n  BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0\n  Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25\n  Workqueue: ib-comp-wq ib_cq_poll_work\n  Call Trace:\n   sg_copy_buffer+0x150/0x1c0\n   isert_recv_done+0xba6/0x2390\n   __ib_process_cq+0xe1/0x390\n   ib_cq_poll_work+0x46/0x150\n\nisert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()\n(ib_isert.c:1160), inlined through isert_rx_opcode().\n\nValidate wc-\u003ebyte_len against the framing in isert_recv_done() before the\nPDU reaches any handler, and reinstate the connection if it is short.\nBecause the test compares without subtracting the header length, it also\nrejects PDUs shorter than the iSER and iSCSI headers, which would otherwise\nbe parsed out of stale descriptor contents. The login handler rejects PDUs\nshorter than ISER_HEADERS_LEN (commit 29e7b925ae6d (\"IB/isert: Reject login\nPDUs shorter than ISER_HEADERS_LEN\")) but does not bound the declared\nlength either; that is fixed in the next patch. The data handlers had no\nlength check at all.\n\nisert reads the data segment from a fixed offset: isert_get_data()\nreturns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for\nan AHS.  The bytes the handlers touch are therefore exactly\n[ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum\nagainst wc-\u003ebyte_len bounds precisely the region that is read.  An AHS\nterm would only make the test stricter without bounding anything furth\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"IB/isert: reject PDUs declaring more data than was received","id":"CVE-2026-90414","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"RDMA/cxgb4: free STAG index when TPT entry write fails","id":"CVE-2026-90415"},"packages":[],"prev":{"headline":"IB/isert: reject login PDUs declaring more data than was received","id":"CVE-2026-90413"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A remote attacker can trigger an out-of-bounds read in the Linux kernel iSER driver by declaring oversized data segments, potentially causing information disclosure or crashes.","url":"https://insights.sbomify.com/CVE-2026-90414/"}