External risk intelligence

Linux Kernel iSER Login PDU Underflow Crash

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-53176

The vulnerability exists in the iSER (iSCSI Extensions for RDMA) driver within the Linux kernel. While network-reachable, iSER is typically deployed within private, high-performance data center fabrics or specialized storage area networks rather than directly exposed to the public internet. Access is generally restricted to authorized hosts within a local or managed storage network.

Linux Kernel

3.10 to before 5.10.2595.11 to before 5.15.2105.16 to before 6.1.1766.2 to before 6.6.1436.7 to before 6.12.946.13 to before 6.18.366.19 to before 7.0.137.1

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Linux kernel's iSER protocol implementation, allowing an unauthenticated remote attacker to crash a system by sending a malformed network message. The issue lies in how the system processes login requests, leading to a buffer overflow that can cause a denial-of-service condition.

A flaw in Linux kernel's iSER networking.
It enables remote system crashes without authentication.
Confirm relevance and exposure for this kernel issue.

Attack Path

How an attacker could exploit the issue

An attacker could target this vulnerability by sending a crafted login request over the network to a system running the Linux kernel's iSER driver. Because this vulnerability occurs before any authentication, the attacker does not need special privileges or credentials. The malformed request causes an integer underflow, leading to an out-of-bounds memory write that crashes the system.

Network access required.
Send malformed login request.
System crash, denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to crash a target system when an iSER initiator posts a login request with fewer than 76 bytes. This occurs before authentication, meaning no credentials are required to trigger the crash. The Linux kernel's iSER driver mishandles the length of incoming login PDUs, leading to a buffer overflow that causes a denial of service.

System stability at risk.
Remote unauthenticated attacker may cause crash.
Denial of service on target node.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's iSER driver is susceptible to a critical vulnerability that allows remote unauthenticated attackers to crash nodes by sending malformed login PDUs. Ownership for remediation likely falls to the platform or infrastructure teams responsible for managing the Linux kernel and its network drivers, in coordination with any teams overseeing storage or RDMA deployments. The first practical step involves identifying all systems running the affected kernel version, confirming if iSER is enabled and if these systems are reachable from untrusted networks, and then planning remediation during the next maintenance window.

Platform/infrastructure teams own remediation.
Verify iSER usage and network reachability.
Plan targeted kernel updates or configuration changes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the iSER component in the Linux kernel?

iSER stands for iSCSI Extensions for RDMA. It is a specialized network protocol driver within the Linux kernel that allows storage traffic to bypass traditional network layers for higher performance. It is primarily used in data centers and high-speed storage area networks to move large amounts of data efficiently between servers and storage devices.

How does CVE-2026-53176 cause a system crash?

This vulnerability involves an integer underflow flaw. When the iSER driver receives a login request shorter than the expected 76 bytes, the code incorrectly calculates the payload length as a negative number. This negative value is later treated as an extremely large positive number during a memory copy operation, leading to an out-of-bounds write that crashes the system.

Do I need to be authenticated to trigger this crash?

No. The vulnerability exists during the initial login handshake phase, which occurs before any authentication checks are performed. An attacker simply needs the ability to send a crafted, undersized network packet to a system running the affected iSER driver to trigger the memory fault.

Is my system at risk if it uses iSER?

According to Halo Surface Signal, the risk is typically lower for systems not exposed to the public internet. Because iSER is usually deployed within private, high-performance fabrics or restricted storage networks, the likelihood of an external attacker reaching your service is generally considered unlikely compared to web-facing applications.

How should I respond to this Linux kernel vulnerability?

Begin by identifying which servers in your environment have the iSER driver enabled. Once identified, evaluate whether those systems are reachable from untrusted network segments. Coordinate with your infrastructure teams to prioritize kernel updates that include the fix, scheduling these changes according to your standard maintenance window procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.