External risk intelligence

Linux Kernel SCSI Target PR-OUT TransportID Parsing Buffer Overflow.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72084

This vulnerability exists within the Linux kernel SCSI target subsystem. While iSCSI target ports can be network-reachable, they are typically deployed within restricted storage area networks (SANs) or data center fabric environments rather than directly exposed to the public internet. Public internet exposure for raw block-level SCSI traffic is an uncommon configuration.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in the Linux kernel's SCSI target subsystem that could allow an attacker to cause a system crash by submitting specially crafted data. The issue lies in how certain commands handle data parsing, potentially leading to an out-of-bounds read. While the vulnerability is rated critical, its actual impact depends on the specific configuration and exposure of affected Linux systems.

A flaw in Linux kernel data handling can cause system crashes.
Critical flaw exists, but real-world impact is uncertain.
Confirm relevance and exposure of affected Linux systems.

Attack Path

How an attacker could exploit the issue

An attacker can send specially crafted data to a Linux system, targeting its SCSI subsystem. If the system exports devices via iSCSI, a guest system using vhost-scsi or any fabric delivering a PR OUT could be exploited. This could lead to the system crashing due to an out-of-bounds read.

No prior access required.
Triggered by crafted SCSI data.
Risk of system crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to read or write memory outside of allocated buffers within the Linux kernel's SCSI target subsystem. This could occur when a specifically crafted Persistent Reserve Out (PR-OUT) TransportID is sent to an iSCSI target. The consequence of this memory corruption can lead to a system crash or potentially enable unauthorized modifications to kernel memory.

Kernel memory.
Malicious PR-OUT TransportID.
System crash or memory corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SCSI target subsystem requires identification of affected systems, assessment of their network reachability and criticality, and confirmation of ownership. The first practical step involves locating all instances of the affected technology, understanding their exposure, and engaging the accountable owner to plan remediation based on risk.

Ownership: Infrastructure and platform teams.
Verify first: Identify and confirm network exposure.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SCSI target subsystem?

It is a core component that allows a Linux machine to act as a storage server. It enables the system to present local storage to other computers over a network—commonly using the iSCSI protocol—so that those remote systems can treat the storage as if it were directly attached locally.

How does CVE-2026-72084 lead to an out-of-bounds read?

The vulnerability is a memory safety flaw. When processing specific 'Persistent Reserve Out' commands, the kernel fails to check if the incoming data fits within its allocated buffer. An attacker can supply a malformed data identifier that lacks a proper ending, causing the software to scan past the buffer's boundary and potentially crash the kernel.

Does any legitimate SCSI traffic trigger this vulnerability?

No. Legitimate communication follows strict format specifications and includes valid lengths. The bug is triggered only by intentionally malformed data where the identifier string is missing expected markers or proper terminators, forcing the system's search function to walk into memory areas it should not access.

Is my system vulnerable according to Halo Surface Signal?

Halo Surface Signal identifies this as 'Unlikely' for most, as these SCSI targets usually reside within internal storage area networks or data centers, not the public internet. While the threat is technically critical, it requires direct network reachability to the SCSI target, which is rare for standard web-facing configurations.

What steps should I take if I use Linux SCSI targets?

Begin by auditing your infrastructure to identify which systems are currently acting as iSCSI targets. Verify their network placement to confirm if they are restricted to internal segments or inadvertently exposed. Once identified, prioritize these systems for kernel updates and coordinate with your infrastructure team to plan a maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.