HIGH Introduced in 6.5
target iblock PrOut Deref
CVE-2026-80691
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI6.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capability checks through ops->pr_clear. The error check allows unimplemented hooks to pass through the gate, resulting dereferencing a NULL function pointer. Check whether the hooks that need to be called are supported.
02KernelScan AI Analysis
Risk summary
The SCSI target iblock driver incorrectly validates Persistent Reservation (PR) operation callbacks for PREEMPT and RELEASE commands. When the underlying block device lacks specific PR hooks, the wrong NULL check allows execution to proceed and dereference a NULL function pointer, causing a kernel panic. This requires an attacker with access to the SCSI target subsystem, typically a privileged initiator or target administrator.
Vulnerability analysis
The driver handling persistent reservation commands checks the wrong capability before executing certain operations. It validates that a general clear operation is supported, but then proceeds to call a more specific preempt or release callback that may not be implemented by the underlying storage device. When that specific callback is missing, the kernel calls a NULL function pointer and crashes. The fix ensures the driver checks the exact callback it intends to use for each command type. An attacker can reach this by sending a persistent reservation command through a SCSI target fabric to a backing device whose driver lacks the required reservation support.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.5 | 6.12.103 | a326b19cfb77 |
| 6.18 | 6.5 | 6.18.44 | bdd8a1297ef1 |
| 6.6 | 6.5 | 6.6.151 | 3c60a8b4037d |
| 7.1 | 6.5 | 7.1.8 | f15bcf9a99b1 |
| mainline | 6.5 | 7.2 | 9c33222bd387 |
| cip/6.12 | 6.5 | 6.12.104-cip30 | a326b19cfb77 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |