Linux Kernel Roundup Flags Two Critical iSCSI Flaws

The Linux kernel CNA reported 129 new CVEs between 26 October and 1 November 2026. The bulk of the disclosures were on 28 October (117) with 26 October contributing the remaining 12. The two most severe flaws are rated 9.8 (Critical) and occur in the iSCSI initiator code within libiscsi. Specifically, CVE-2026-99154 and CVE-2026-99153 are highlighted as the highest‑severity issues, with CVE-2026-99152 (7.5) also noted for a related check in management responses.

CVE Watchtower data cited by the roundup shows 2 Critical, 29 High among the 129 CVEs, and 98 not yet scored. At time of reporting, there is no evidence of active exploitation and none of the flaws appears in the CISA Known Exploited Vulnerabilities catalog.

The two critical iSCSI flaws enable memory corruption via crafted iSCSI traffic: CVE-2026-99154 (libiscsi) rejects a negative task index from a parsed PDU, while CVE-2026-99153 validates the ITT reflected in a Reject PDU. Exploitation would require control or impersonation of an iSCSI target. Other notable high‑severity bugs include CVE-2026-99185 (8.8) in FireWire split‑transaction handling and CVE-2026-99170 (8.8) affecting mount namespaces.

Fixes are in stable kernels 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13, with mainline 7.3 also addressed. The advisory recommends applying the next kernel security update promptly, prioritising hosts using iSCSI, restricting unprivileged namespaces where feasible, and unloading unused drivers such as FireWire to reduce exposure.