CVE-2026-46149

Technical summary

The vulnerability exists in target_tg_pt_gp_members_show(), a sysfs callback in the Linux SCSI target subsystem. The function uses snprintf() to format LUN (Logical Unit Number) paths into a 256-byte stack buffer. snprintf() returns the number of bytes that would have been written if the buffer were large enough, not the actual bytes written. When an iSCSI IQN name (which can be up to 223 bytes) is long, snprintf() returns a value exceeding 256. The subsequent memcpy() operation reads cur_len bytes from the stack buffer without bounds-checking the source. This causes out-of-bounds reads from the kernel stack, copying adjacent kernel memory into userspace via the sysfs interface. When CONFIG_FORTIFY_SOURCE is enabled, the fortify_panic() macro detects the overrun and triggers a kernel panic. The fix mirrors a prior patch (commit 27e06650a5ea) applied to a similar function, target_lu_gp_members_show(), which had already been corrected but was missed in this variant.

Business impact

This vulnerability creates two distinct business risks. First, any local user on an affected system can trigger a denial-of-service condition, rendering storage services unavailable without requiring root privileges. Second, on systems without fortification mitigations, kernel memory disclosure enables privilege escalation reconnaissance—an attacker can read sensitive kernel state to identify gadgets or credentials for further exploitation. For organizations operating Linux-based storage appliances, SAN controllers, or hypervisors, this translates to potential service disruptions and heightened risk of lateral movement if memory disclosure is exploited.

Affected systems

All Linux kernel versions containing the vulnerable code path in the SCSI target subsystem's configfs interface are affected. This impacts systems running the Linux kernel with SCSI target support enabled (typically storage appliances, hypervisors, and systems exporting block devices via iSCSI or other SCSI-over-fabric protocols). Systems must have the target subsystem configured and the sysfs interface accessible to local users to be exploitable.

Exploitability

Exploitation requires local access and low privileges (a standard unprivileged user account). No network access is needed. An attacker simply reads from /sys/kernel/config/target/iscsi/.../tg_pt_gp/*/members to trigger the vulnerability. Triggering denial-of-service on CONFIG_FORTIFY_SOURCE systems is trivial; leaking kernel memory on systems without fortification requires reading the sysfs file repeatedly to extract useful data. The barrier to exploitation is low.

Remediation

Apply the kernel patch that bounds the snprintf() return value before using it in memcpy(), matching the fix already applied to target_lu_gp_members_show(). The patch ensures that only the actual bytes written to the buffer (capped at the buffer size) are read and copied to userspace. Verify the patch version against your Linux distribution's security advisory. Interim mitigation: restrict access to /sys/kernel/config/target via file permissions or namespacing if local user access can be limited.

Patch guidance

Patches are available through your Linux distribution's security update channels. Check advisories from Red Hat, Canonical, SUSE, and other vendors for kernel updates addressing CVE-2026-46149. The fix involves a bounds check on the snprintf() return value in tg_pt_gp_members_show(). Apply the latest stable or LTS kernel version recommended by your vendor. Test in a non-production environment before rolling out broadly, particularly on storage-critical systems.

Detection guidance

Monitor kernel logs for fortify_panic() messages or stack overflow warnings on systems with CONFIG_FORTIFY_SOURCE enabled, which indicate exploitation attempts. On systems without fortification, detection is difficult; however, repeated non-root access to /sys/kernel/config/target/**/members files may signal reconnaissance. Implement file integrity monitoring on configfs paths if feasible. Intrusion detection can flag unusual sysfs reads from unprivileged processes. Consider restricting sysfs access via AppArmor, SELinux, or Seccomp policies to mitigate attack surface.

Why prioritize this

This is a HIGH-severity local privilege escalation and denial-of-service issue (CVSS 7.1). While it requires local access, it is trivial to trigger and affects any system running affected Linux kernels with SCSI target support. Storage appliances, hypervisors, and multi-tenant systems are at elevated risk. Rapid patching is warranted for production storage infrastructure.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and impacts to both confidentiality (information disclosure via memory leak) and availability (kernel panic). The absence of integrity impact (I:N) prevents a critical rating, but the combination of memory leak and DoS makes this a strong HIGH priority.

Frequently asked questions