CVE-2026-72084

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Bound PR-OUT TransportID parsing to the received buffer

corescsi3decodespeciport() and corescsi3emulateregisterandmove()

hand the raw PERSISTENT RESERVE OUT parameter buffer to

targetparseprouttransport_id() without telling it how many bytes are

valid.  For an iSCSI TransportID (FORMAT CODE 01b),

iscsiparseprouttransport_id() locates the ",i,0x" ISID separator with

an unbounded strstr() (and on the error path prints the name with a further

unbounded "%s").  An initiator can submit a TransportID whose iSCSI name

contains neither a ",i,0x" substring nor a NUL terminator, filling the

parameter list to its end, so the scan runs off the end of the buffer.

When the parameter list spans more than one page the buffer is a multi-page

vmap (transportkmapdata_sg()), so the over-read walks into the trailing

vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr).  It

is reachable by any fabric that delivers a PR OUT to a device exported

through an iSCSI TPG, including a guest via vhost-scsi.

Pass the number of received bytes down to the parser and validate the iSCSI

TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up

front: reject it if it is below the spc4r17 minimum or larger than the

received buffer, then bound the separator search, the ISID walk and the

name copy by that length.  This is the length check the callers already

perform after the parse (corescsi3decodespeciport() compares tidlen

against tpdl, corescsi3emulateregisterand_move() validates it against

data_length), moved ahead of the scan.  Also drop the unbounded "%s" of the

unterminated name.

Add per-format explicit name-length checks before copying into i_str,

rather than silently truncating with min_t: for FORMAT CODE 00b reject if

the descriptor body (tid_len - 4 bytes) cannot fit in

istr[TRANSPORTIQN_LEN]; for FORMAT CODE 01b reject if the name portion

(from &buf[4] up to the separator) cannot fit.  Both checks make the bounds

intent explicit at each format branch.

While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x"

separator sits at the very end of the descriptor: that leaves an empty ISID

and points the returned port nexus pointer at buf + tid_len, one past the

descriptor, which the registration code (_corescsi3locatepr_reg(),

_corescsi3allocregistration()) then dereferences as the ISID string --

the same over-read of the parameter buffer for a malformed descriptor.