Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer. Check whether the hooks that need to be called are supported.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:54.587Z",
  "pubdate": "2026-08-28T08:16:54.587Z",
  "executiveSummary": "The Linux kernel's iSCSI target subsystem (iblock) contains a null pointer dereference vulnerability within the Persistent Reservation (PR) execution flow.\nThe vulnerability stems from improper validation of callback function pointers within the iblock_execute_pr_out() function.\nSpecifically, operations such as PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE fail to adequately verify the existence of the ops->pr_clear callback before invocation.\nAn unauthenticated or authenticated attacker with access to the iSCSI target interface can trigger this flaw by submitting specifically crafted PR OUT SCSI commands.\nSuccessful exploitation results in a kernel panic, leading to a complete Denial of Service (DoS) of the affected storage target service.\nThe issue poses a high risk to system availability, particularly in enterprise storage environments relying on Linux-based iSCSI targets.\nThe vulnerability highlights a critical failure in input validation and pointer safety within the SCSI target mid-layer and backend driver interactions.",
  "technicalDetails": "The vulnerability is located in the drivers/target/target_core_iblock.c file, specifically within the iblock_execute_pr_out() function responsible for handling SCSI Persistent Reservation (PR) output commands.\nThe root cause is a logic error in the validation gate for callback hooks. When the kernel processes PR OUT commands—specifically PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE—the code executes a conditional check on the function pointer ops->pr_clear.\nIn the vulnerable version of the kernel, the implementation incorrectly assumes that the callback hook is always populated or that the null check is sufficient. However, for certain device backends or configurations, the pr_clear hook is not initialized or implemented (null).\nBecause the existing conditional logic fails to enforce a strict check before dereferencing the pointer, the kernel attempts to execute an instruction at address 0x0 (or an offset thereof).\nThe attack flow proceeds as follows: 1) An attacker establishes a connection to the target iSCSI portal. 2) The attacker sends a SCSI PR OUT command (e.g., PREEMPT or RELEASE) via the iSCSI protocol. 3) The target's iblock backend processes the command via iblock_execute_pr_out(). 4) The function reaches the section handling the specific PR operation, and because the corresponding callback is NULL, the CPU encounters an illegal instruction/invalid memory access during the function call.\nThis leads to an immediate kernel oops or panic, causing a system-wide crash. Since the vulnerability is triggered at the kernel level by standard SCSI protocol operations, an attacker does not require elevated privileges beyond the ability to interact with the iSCSI target.\nThe impact is a persistent Denial of Service (DoS) as the kernel crash effectively halts storage I/O and renders the target node unresponsive until a manual reboot occurs.\nThe vulnerability underscores the necessity for robust pointer validation in kernel-space driver callback mechanisms, ensuring that every operation gated by function pointers is validated against NULL before dispatching, regardless of assumed protocol state or device configuration."
}