External risk intelligence

Linux Kernel libiscsi ITT Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-99153

This vulnerability is located deep within the Linux kernel's iSCSI subsystem, which handles low-level storage protocol traffic. iSCSI is designed to operate within isolated, trusted storage area networks (SANs) or data center backend fabrics. It is not intended to be exposed to the public internet, and such deployment would be contrary to standard network architecture practices.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's storage subsystem could allow an attacker to disrupt operations by completing tasks improperly, potentially leading to system instability. The main concern is confirming relevance and exposure.

A flaw in storage handling could impact system stability.
It affects core operating system functions.
Confirm relevance and exposure to this kernel component.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a system running a vulnerable version of the Linux kernel. This would trigger a flaw in how the kernel handles SCSI Reject PDUs, potentially leading to unauthorized code execution or system instability.

Network access required.
Triggered by a malformed SCSI Reject PDU.
Risk of system crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and availability of SCSI storage operations within the Linux kernel. When a specially crafted Reject PDU is processed, it may lead to an uncontrolled completion of an in-flight SCSI command, potentially causing data corruption or system instability.

SCSI command integrity and availability.
Invalid PDU processing could cause task issues.
Unpredictable command completion; potential data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's iSCSI subsystem is likely managed by infrastructure or platform teams responsible for storage and networking. The first practical step is to identify all systems using the affected iSCSI implementation, confirm their exposure and criticality, and then coordinate remediation with the accountable system owners.

Infrastructure and platform teams own remediation.
Verify iSCSI implementation and exposure.
Plan risk-based remediation or updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel libiscsi component?

The libiscsi component is a part of the Linux kernel that implements the iSCSI protocol. This protocol allows a system to connect to and communicate with remote storage devices over a network, effectively treating them as if they were directly attached local disks. It is commonly used in data centers and storage area networks (SANs) to facilitate high-speed, scalable data storage and server virtualization.

What does CVE-2026-99153 mean for system security?

This vulnerability is an input validation error within the iSCSI subsystem. When the kernel processes a Reject PDU (Protocol Data Unit), it fails to properly verify the Initiator Task Tag (ITT) provided by the network peer. This weakness allows the kernel to incorrectly associate the reject message with an existing, unrelated task, which can cause internal state corruption, system crashes, or the premature and invalid completion of ongoing storage commands.

How is this iSCSI vulnerability triggered?

An attacker triggers this bug by sending a specially crafted, malicious iSCSI Reject PDU to a vulnerable system. Because the vulnerability exists in the logic that processes these incoming network messages, simply having an active iSCSI session with an untrusted or compromised storage target is the primary precondition. Normal, valid storage traffic will not trigger the fault; it requires specifically manipulated packet data designed to exploit the missing validation.

Is my infrastructure at risk from CVE-2026-99153?

Halo Surface Signal indicates that exploitation is very unlikely for most environments. The affected code handles low-level storage traffic typically confined to trusted, isolated storage area networks or backend data center fabrics. Since iSCSI is not designed to be exposed to the public internet, systems that follow standard, secure network architecture practices and keep storage traffic isolated from untrusted networks face a significantly reduced risk of external exploitation.

What steps should I take if I use iSCSI?

Begin by identifying all systems in your environment that utilize the Linux kernel's iSCSI implementation. Work with your infrastructure or platform teams to verify that these storage connections are appropriately segmented and isolated from public or untrusted network access. Once inventory and exposure are confirmed, prioritize patching these systems according to your organization's standard kernel update lifecycle and vulnerability management procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.