CVE-2026-74557

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the

target-supplied data segment. The segment carries a 2-byte sense length

followed by the sense bytes, so it must hold 2 + senselen bytes, but the

bounds check only requires datalen >= senselen:

senselen = get_unaligned_be16(data);

if (datalen < senselen)

goto invalid_datalen;

memcpy(sc->sense_buffer, data + 2,

min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));

A target that returns a SCSI Response whose datalen equals senselen

(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +

2 read up to two bytes past the received data. Those bytes are stale

conn->data contents and end up in the command's sense buffer, which is

returned to userspace.

Account for the 2-byte sense length prefix in the check.