External risk intelligence

Linux Kernel libiscsi Negative Task Index Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-99154

The vulnerability exists within the Linux kernel's iSCSI subsystem, specifically related to PDU task index parsing in the libiscsi layer. While the affected code handles network traffic, iSCSI is typically deployed in private data center environments for storage area networking, not exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability in the Linux kernel's iSCSI component could allow an attacker to bypass protections. The issue involves how the system handles certain index values, potentially leading to unauthorized access or modification of data within storage networks. The main concern is confirming if our environment utilizes this specific Linux kernel component for iSCSI operations.

Negative index allows unauthorized data access.
Affects secure storage network communications.
Confirm relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to a Linux system. This traffic would be processed by the iSCSI subsystem, which incorrectly handles a negative task index. This could allow an attacker to read from memory outside of the intended array, potentially leading to further system compromise.

Network access required.
Malformed network data triggers vulnerability.
Risk of memory corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to read or write memory outside of allocated bounds within the Linux kernel's iSCSI subsystem. This occurs when a negative task index, which should be rejected, is instead used to access the `session->cmds` array. When supported by the advisory, this could affect the integrity and availability of the system.

Kernel memory access and manipulation.
Negative index bypasses array bounds checks.
Potential system instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's iSCSI implementation likely falls under the responsibility of infrastructure or platform teams managing storage and networking components. The first practical step is to identify all systems utilizing the affected kernel version and iSCSI, assess their exposure and criticality, and then coordinate remediation efforts.

Infrastructure and platform teams own remediation.
Verify iSCSI usage and system criticality.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's libiscsi component?

The libiscsi library is a core part of the Linux kernel used to implement iSCSI, a networking protocol that allows servers to connect to remote storage devices. By enabling computers to access storage over IP networks, it functions as a virtual local disk, essential for enterprise data centers and SAN environments.

What kind of vulnerability is CVE-2026-99154?

This is an out-of-bounds memory access flaw. Specifically, the software fails to reject negative task index values when processing network data. Because the system only checks for index values that are too high, a negative number allows the kernel to read or write memory addresses located before the intended data array.

How does an attacker trigger this bug?

An attacker must send specially crafted iSCSI PDU network traffic to a vulnerable system. The flaw is triggered when the libiscsi layer parses this data and encounters a negative task index. Legitimate, well-formed iSCSI traffic that does not contain these negative index values will not trigger the vulnerability.

Is my system at risk if it isn't internet-facing?

Halo Surface Signal indicates that while the flaw is technically reachable over a network, it is unlikely to be exposed because iSCSI is generally deployed within private, segmented storage area networks. Systems strictly isolated from external traffic and untrusted internal users face a significantly lower risk profile.

What should I do to address this issue?

Start by identifying all servers in your environment that actively utilize iSCSI and are running affected Linux kernel versions. Coordinate with your infrastructure and platform teams to prioritize these systems for patching. Schedule these updates during your next maintenance window to maintain system stability while closing the security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.