Buffer Initialization Vulnerability in Linux Kernel

CVE-2026-43055

What is CVE-2026-43055?

In the Linux kernel, a vulnerability exists within the scsi target subsystem that leads to improper initialization of the aio_cmd->iocb for the ki_write_stream. When a write command is executed, an erroneous ki_write_stream value can result in misleading write failure statuses, particularly when comparing iocb->ki_write_stream against the maximum allowed. The issue has been addressed by switching to kzalloc_flex for aio_cmd allocation, ensuring that ki_write_stream is initialized to zero, thereby enhancing the stability and reliability of the SCSI target functionality.

References