已开启
CVE-2026-90011 #19038
qiao-yifan4创建于 9月17日
devstation-robot
9月17日 评论：
9月17日 评论：
检测到新建 CVE Issue，CVE-ID: CVE-2026-90011。
你可以通过以下两种方式使用 CVE 修复服务：
-
分支影响分析
- 在本 Issue 下评论：
/analysis_branches - 系统将自动分析各个分支是否受影响，并在本 Issue 下给出表格形式的分析结果；
- 在本 Issue 下评论：
-
在指定分支上创建 PR（修复提交）
- 在本 Issue 下按如下格式评论（
branch、name、email为必填字段，每个字段单独一行）：
- 在本 Issue 下按如下格式评论（
/create_pr
branch: OLK-6.6 OLK-5.10
name: dev
email: dev@devstation.com
backport-engine: opencode
- 说明：
branch: 需要创建 PR 的目标分支列表，例如OLK-6.6 OLK-5.10；name: PR 签名人姓名（如责任人或安全负责人）；email: PR 签名人邮箱；backport-engine（可选）：可选portgpt、mystique或opencode；不填时默认使用opencode；
系统会根据上述信息自动在指定分支上创建 PR，并在本 Issue 下反馈结果。
provided by DevStation.
9月17日 修改了issue 的描述
9月17日 将 peterpangogogo 设为负责人
openeuler-ci-bot9月17日 将 wkfxxx、zeng_zhaorong、sanglipeng、qiao-yifan4、oekernel、hanjunguo 设为负责人，移除负责人 peterpangogogo
9月17日 将 wkfxxx、zeng_zhaorong、sanglipeng、qiao-yifan4、oekernel、hanjunguo 设为负责人，移除负责人 peterpangogogo
9月17日 添加了label：sig/Kernel
此处折叠了46条消息 查看更多
26 天前 issue状态由 进行中 改变为 待办的
14 天前 关闭了 issue
openeuler-ci-bot
14 天前 评论：
14 天前 评论：
经过cve-manager解析，部分分支PR未合入，如红色字体所示：
原因说明：
1.master:不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4:正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP1:正常修复(PR未合入)
6.openEuler-24.03-LTS-SP3:正常修复(PR未合入)
7.openEuler-24.03-LTS-SP4:正常修复(PR未合入)
8.openEuler-22.03-LTS-SP3:不修复-超出修复范围
9.openEuler-24.03-LTS:不修复-超出修复范围
10.openEuler-24.03-LTS-SP2:不修复-超出修复范围
14 天前 重新打开了 issue
14 天前 issue状态由 待办的 改变为 进行中
一、漏洞信息
漏洞编号：CVE-2026-90011
漏洞归属组件：kernel
漏洞归属的版本：5.10.0
CVSS评分：
BaseScore：9.1 Critical
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:scsi: target: iscsi: Reserve a terminator byte for the login payloadiscsi_target_check_login_request() rejects a login PDU whoseDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is > andlogin->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRSbytes. Since iscsit_get_login_rx() receives payload_length + paddingbytes, where padding = ((-payload_length) & 3);any payload_length from 8189 to 8192 fills the whole 8192 bytebuffer. The write stays in bounds, but no byte is left for a NULterminator.The buffer is subsequently consumed as a C string. In the CHAP pathchap_check_algorithm() calls kstrdup(a_str), and extract_param() callsstrstr(in_buf, pattern) followed by strlen_semi(), none of which take alength. convert_null_to_semi() additionally rewrites every embedded NULto ; , so even a payload made of well formed NUL separated key=valuerecords is left without a terminator. These walk past the end of theobject into adjacent slab memory. It is reachable by an unauthenticatedinitiator against a portal configured for CHAP; when authentication isnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None andthe CHAP path is never entered.Allocate one extra byte. kzalloc() zeroes it and nothing ever writes toit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRSbytes, so the buffer is always terminated.
漏洞公开时间：2026-09-16 19:17:13
漏洞创建时间：2026-09-17 14:37:37
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-90011
更多参考(点击展开)
漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：
详情(点击展开)
二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:scsi: target: iscsi: Reserve a terminator byte for the login payloadiscsi_target_check_login_request() rejects a login PDU whoseDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' andlogin->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRSbytes. Since iscsit_get_login_rx() receives payload_length + paddingbytes, wherepadding = ((-payload_length) & 3);any payload_length from 8189 to 8192 fills the whole 8192 bytebuffer. The write stays in bounds, but no byte is left for a NULterminator.The buffer is subsequently consumed as a C string. In the CHAP pathchap_check_algorithm() calls kstrdup(a_str), and extract_param() callsstrstr(in_buf, pattern) followed by strlen_semi(), none of which take alength. convert_null_to_semi() additionally rewrites every embedded NULto ';', so even a payload made of well formed NUL separated key=valuerecords is left without a terminator. These walk past the end of theobject into adjacent slab memory. It is reachable by an unauthenticatedinitiator against a portal configured for CHAP; when authentication isnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None andthe CHAP path is never entered.Allocate one extra byte. kzalloc() zeroes it and nothing ever writes toit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRSbytes, so the buffer is always terminated.The Linux kernel CVE team has assigned CVE-2026-90011 to this issue.
openEuler评分：
9.1
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(6.18.40):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS-Next(6.6.0):不受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP3(6.6.0):受影响
7.openEuler-24.03-LTS-SP4(6.6.0):受影响
8.openEuler-22.03-LTS-SP3(5.10.0):受影响
9.openEuler-24.03-LTS(6.6.0):受影响
10.openEuler-24.03-LTS-SP2(6.6.0):受影响
修复是否涉及abi变化(是/否)：
1.master(6.18.40):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP4(5.10.0):否
4.openEuler-24.03-LTS-Next(6.6.0):否
5.openEuler-24.03-LTS-SP1(6.6.0):否
6.openEuler-24.03-LTS-SP3(6.6.0):否
7.openEuler-24.03-LTS-SP4(6.6.0):否
8.openEuler-22.03-LTS-SP3(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-SP2(6.6.0):否
原因说明：
1.master(6.18.40):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):正常修复
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP3(6.6.0):正常修复
7.openEuler-24.03-LTS-SP4(6.6.0):正常修复
8.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
9.openEuler-24.03-LTS(6.6.0):不修复-超出修复范围
10.openEuler-24.03-LTS-SP2(6.6.0):不修复-超出修复范围