In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch… (CVE-2026-98479)

The Linux kernel's libiscsi_tcp module mishandles the data direction check for Data-In PDUs in iscsi_tcp_hdr_dissect(). Specifically, when processing a WRITE command, the function copies the PDU's data segment into the command's scatterlist without verifying if the command is a read operation. This contrasts with iscsi_tcp_r2t_rsp(), which correctly rejects R2T responses for commands not marked as DMA_TO_DEVICE. Consequently, a malicious or misbehaving target can cause the initiator to overwrite its own pinned pages or page cache with target-supplied data, leading to data corruption. The vulnerability was observed with a test target sending a 512-byte Data-In after an R2T for a 128 KB write, resulting in corrupted buffers and page cache without detection.

The vulnerability can cause data corruption on the initiator side by overwriting the caller's memory pages with data supplied by the target during WRITE commands. This affects both direct I/O (O_DIRECT) and buffered I/O, potentially leading to silent data corruption in the page cache. There is no indication of remote code execution or denial of service from the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description suggests that the fix involves adding a data direction check in the Data-In branch of iscsi_tcp_hdr_dissect(), similar to the existing check in iscsi_tcp_r2t_rsp(). Until an official fix is available, users should monitor vendor advisories for patches addressing this issue.