* [CVE-2026-90413][MODERATE 7.0] IB/isert: reject login PDUs declaring more data than was received [ Upstream
@ 2026-09-18 9:23 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-18 9:23 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-90413
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: IB/isert: reject login PDUs declaring more data than was received [ Upstream
Commit: b1f3313e7b3e396e4985fea5c709477387e0a065
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b1f3313e7b3e396e4985fea5c709477387e0a065
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90413
Analysis date: Fri, 18 Sep 2026 05:23:39 -0400
ActionableScore: 5
ActionableScore lower bound: 4
Actionable bucket: Actionable Moderate
Manual review required: YES
Summary:
No one-sentence report phrase was found.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-90413 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90413
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: MODERATE 7.0
Manual review required: YES
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-90413 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-90413 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H';CWE-125;CWE-126;*CWE-20;Other CVSS 'AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H';BEST CVSS score: '7.6';DESCR 'An out of bounds read exists in the iSER target login path because the login PDU DataSegmentLength can be larger than the number of bytes actually received into the login buffer. A remote initiator on the RDMA storage fabric can trigger this before authentication by declaring a larger login payload than it sends, causing kmemdup_nul to read past the fixed MAX_KEY_VALUE_PAIRS login request buffer. For the CVSS the PR:N value is selected because the malformed login PDU is processed before authentication and no local user context on the target is required beyond reachability to the iSER target. The issue is network reachable on systems that expose an iSER target, but practical exposure is usually limited to isolated storage or data center networks rather than the public Internet. Impact is at least denial of service via kernel crash or sanitizer detected OOB read. In the paranoid score, limited confidentiality and integrity impact are kept because attacker controlled over read length may copy adjacent kernel heap bytes into login parsing state, but the patch does not show an OOB write or UAF primitive.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate (with actual score 5) YES READ KASAN OOB NETWORK LOG LINUS KPANIC KPANIC INCREASED_TO_MODERATE7_BASED_ON_GUESSCVSS NO NO checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=5
ActionableScoreLower=4
PrimitiveClass=CLASS_C
RealUAF=NO
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=NO
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
1. ActionableScore
* Raw conservative score: 4
* Conservative score: 4
* Raw paranoid score: 5
* Paranoid score: 5
* Final recommended bucket: **Actionable Moderate**::
No floor or cap changed the score.
2. Signal breakdown
Conservative positive signals:
* +2 Remote or fabric reachable trigger: a remote iSER initiator on the RDMA storage fabric can send a malformed login PDU before authentication.
* +1 Reliable kernel crash or strong DoS: KASAN shows slab out of bounds reads in kmemdup_nul, and large declared lengths such as 8193, 16384, and 61440 are reported to reproduce the issue.
* +1 Memory layout invariant restoration: the patch restores the required invariant that declared DataSegmentLength must not exceed the bytes actually received into the fixed login buffer.
Paranoid additional signal:
* +1 Weak indirect parsing impact: the attacker controlled declared length can make kmemdup_nul copy bytes beyond the fixed login request buffer into a temporary login parsing buffer, so limited parser state influence is technically defensible even though disclosure or write control is not shown.
Non awarded signals:
* +0 RealUAF not awarded: no use after free or stale lifetime object use is established.
* +0 Strong corruption not awarded: no OOB write, arbitrary write, controlled reclaim, type confusion, callback control, or refcount takeover is shown.
* +0 Confidentiality not awarded conservatively: kernel heap bytes may be copied internally, but no user visible, network visible, or device visible disclosure path is established.
* +0 Integrity not awarded conservatively: no unauthorized write or protected state modification is demonstrated.
* +0 Practical exploit chain not awarded: trigger to crash is already counted, and no chain to LPE or data theft is supplied.
* +0 Extra availability not awarded: the same crash or KASAN fault is not counted twice.
* No negative privilege penalty: the malformed PDU is processed before authentication, so host admin privilege is not required by the attacker.
* No rare hardware penalty: RDMA or iSER deployment limits exposure, but the issue is still a network storage target path and the prompt evidence uses soft RoCE for reproduction.
3. Reachability analysis
The evaluated attacker is a remote iSER initiator with reachability to the iSER target over an RDMA storage fabric. The malformed login PDU is handled before authentication, so HostAdminRequired=NO.
NamespaceScopedPrivilege=NO because this is not a namespace capability issue. No local namespace creation or namespace scoped CAP_NET_ADMIN path is needed for the described trigger.
There is prior target deployment setup in the operational sense: the victim must run an iSER target and expose it on a reachable RDMA or RoCE fabric. This is not a privilege requirement for the attacker once the service is reachable. The issue is not the ordinary iSCSI over TCP path, because the commit states that iscsit over TCP validates the declared length and reads exactly that many bytes.
No race is required. The trigger is a deterministic malformed login PDU where the BHS declares more payload than the HCA actually placed in the login buffer.
4. Primitive and severity interpretation
The exact primitive is a pre authentication slab out of bounds read from login->req_buf, a fixed MAX_KEY_VALUE_PAIRS 8192 byte allocation. The attacker controls the declared DataSegmentLength in the login PDU BHS, while the actual received length is smaller.
This is not an active structured object UAF and not fixed stale storage. It is a bounds validation failure between received data length and later parser declared length.
PrimitiveClass=CLASS_C because the demonstrated behavior is primarily OOB read leading to KASAN report or kernel crash. The OOB read is real, but no independently useful disclosure channel, write primitive, controlled corruption, or privilege escalation path is established.
ImportantCandidate=NO because the evidence supports Actionable Moderate manual review, not an Important preserving primitive. The paranoid score keeps the issue from automatic closure because it is pre authentication and network reachable on exposed iSER targets, but the patch does not support CLASS_A or strong CLASS_B treatment.
AutoDowngradeAllowed=NO because this is a pre authentication network reachable kernel memory safety issue with attacker controlled over read length. Even without proven LPE or disclosure, automatic closure as an ordinary low risk issue would risk a false negative.
Likely operational severity is Actionable Moderate. It is important to patch exposed iSER targets, especially in shared or less trusted storage fabrics, but current evidence does not justify Strong Important without a demonstrated leak, write, UAF, or LPE primitive.
5. One-sentence report phrase
A pre authentication iSER login PDU can declare a DataSegmentLength larger than the bytes actually received, causing kmemdup_nul to read past the fixed login request buffer and potentially crash the kernel on exposed RDMA storage targets.
6. Manual review recommendation
MANUAL CHECK REQUIRED
Reason: this is a pre authentication network reachable kernel OOB read in a storage target path with attacker controlled length, even though the currently demonstrated impact is mainly DoS and no disclosure or write primitive is proven.
7. Call-site confidence
Call-site confidence: high
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: IB/isert: reject login PDUs declaring more data than was received [ Upstream
Commit: b1f3313e7b3e396e4985fea5c709477387e0a065
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b1f3313e7b3e396e4985fea5c709477387e0a065
Changed files:
drivers/infiniband/ulp/isert/ib_isert.c
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b1f3313e7b3e396e4985fea5c709477387e0a065
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-90413 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90413
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
The Best / paranoid CVSS vector: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
The Best / paranoid CVSS score: 7.6
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: 4
Paranoid ActionableScore: 5
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-18 9:23 21% [CVE-2026-90413][MODERATE 7.0] IB/isert: reject login PDUs declaring more data than was received [ Upstream AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox