CVE-2026-43055

Vulnerability

Overview

The Linux kernel's SCSI target subsystem, in the target_core_file module, contains an uninitialized memory vulnerability affecting asynchronous I/O (AIO) write operations. When executing a write command via fd_execute_rw_aio(), the aio_cmd->iocb structure is allocated without proper initialization. Specifically, the ki_write_stream field may retain a bogus value from uninitialized memory.

Exploitation

Mechanism

During a write operation, the block layer checks iocb->ki_write_stream against max_write_streams. An uninitialized ki_write_stream can exceed this limit, causing the kernel to incorrectly flag the write as exceeding stream limits. This results in an unintended -EIO or similar write failure status being returned to the caller. No authentication is required to trigger this; any process able to issue SCSI commands through the target layer can potentially trigger the condition.

Impact

An attacker able to issue write commands through the SCSI target file backend could cause legitimate write I/O to fail, leading to data loss or corruption. Repeated exploitation may result in persistent denial of service against storage targets. The CVSS v3 base score of 7.5 (High) reflects the potential for disruption without high privileges or user interaction.

Mitigation

The fix was committed to the Linux kernel stable trees. The patch replaces the plain allocation with kzalloc_flex, ensuring ki_write_stream is zeroed, thus preventing the uninitialized memory issue [1][2][3]. Users should update to a kernel version containing the respective stable commits. No workaround is known for unpatched kernels.