CVE-2026-90011

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Reserve a terminator byte for the login payload

iscsitargetcheckloginrequest() rejects a login PDU whose

DataSegmentLength exceeds MAXKEYVALUE_PAIRS, but the test is '>' and

login->reqbuf is allocated with exactly MAXKEYVALUEPAIRS

bytes. Since iscsitgetloginrx() receives payloadlength + padding

bytes, where

padding = ((-payload_length) & 3);

any payload_length from 8189 to 8192 fills the whole 8192 byte

buffer. The write stays in bounds, but no byte is left for a NUL

terminator.

The buffer is subsequently consumed as a C string. In the CHAP path

chapcheckalgorithm() calls kstrdup(astr), and extractparam() calls

strstr(inbuf, pattern) followed by strlensemi(), none of which take a

length. convertnullto_semi() additionally rewrites every embedded NUL

to ';', so even a payload made of well formed NUL separated key=value

records is left without a terminator. These walk past the end of the

object into adjacent slab memory. It is reachable by an unauthenticated

initiator against a portal configured for CHAP; when authentication is

not required iscsiloginzerotsihs2() rewrites AuthMethod to None and

the CHAP path is never entered.

Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to

it, as every writer copies to offset 0 for at most MAXKEYVALUE_PAIRS

bytes, so the buffer is always terminated.