Multiple security vulnerabilities have been identified in the Linux kernel, affecting multiple kernel branches and components involved in storage, networking, graphics, and namespace handling. Most affect multiple kernel branches, while some affect only newer kernels. The overall risk is elevated because several flaws can lead to memory corruption, privilege-related bypasses, or unauthorized access, with the most severe issues concentrated in the iSCSI initiator. No confirmed active exploitation has been reported for the listed vulnerabilities.
CVE-2026-99154 (CVSS 9.8 — Critical): A malicious iSCSI target can supply a negative task index that is not properly validated by the iSCSI initiator. This can allow out-of-bounds memory access on the connected host.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Linux kernel, affecting multiple kernel branches and components involved in storage, networking, graphics, and namespace handling. Most affect multiple kernel branches, while some affect only newer kernels. The overall risk is elevated because several flaws can lead to memory corruption, privilege-related bypasses, or unauthorized access, with the most severe issues concentrated in the iSCSI initiator. No confirmed active exploitation has been reported for the listed vulnerabilities.
CVE-2026-99154 (CVSS 9.8 — Critical): A malicious iSCSI target can supply a negative task index that is not properly validated by the iSCSI initiator. This can allow out-of-bounds memory access on the connected host.[emaillocker id="1283"]
CVE-2026-99153 (CVSS 9.8 — Critical): A malicious iSCSI target can send a Reject PDU that references an arbitrary task identifier in the initiator. This can cause the initiator to operate on an unintended task and potentially corrupt memory.
CVE-2026-99185 (CVSS 8.8 — High): A race condition in FireWire split transaction handling can allow a use-after-free when a response handler and timeout callback process the same transaction. An attacker with access to the adjacent FireWire bus could exploit the flaw.
CVE-2026-99170 (CVSS 8.8 — High): A mount namespace lock bypass can allow a task that is root in its own user namespace to remove a locked mount cover. This can expose files that the cover was intended to hide.
CVE-2026-99216 (CVSS 8.4 — High): An error or exit path in the Hyper-V VMBus driver can leave connection state improperly initialized. An attacker able to trigger the affected path could exploit the stale state.
CVE-2026-99131 (CVSS 8.2 — High): A capability check flaw in XFS can allow users to evade group quota enforcement. A local user with access to an affected XFS filesystem could exploit it to exceed intended storage limits.
CVE-2026-99152 (CVSS 7.5 — High): A malicious iSCSI target can send a management response that names an invalid or unintended task. The iSCSI initiator may process the incorrect task, allowing an attacker controlling or impersonating the target to exploit the flaw.
These vulnerabilities collectively present a significant risk to systems that expose the affected kernel components, especially hosts connected to untrusted storage or virtualization environments. Organizations should prioritize systems with those components for risk review and exposure reduction.
We recommend you to update the Linux kernel to version 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, or 7.3 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]