CVE-2026-43055 Details
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: file: Use kzalloc_flex for aio_cmd The target_core_file doesn't initialize the aio_cmd->iocb for the ki_write_stream. When a write command fd_execute_rw_aio() is executed, we may get a bogus ki_write_stream value, causing unintended write failure status when checking iocb->ki_write_stream > max_write_streams in the block device. Let's just use kzalloc_flex when allocating the aio_cmd and let ki_write_stream=0 to fix this issue.
A vulnerability exists in the Linux kernel's SCSI target component, specifically within the target_core_file. The issue arises because the component does not properly initialize the asynchronous I/O command's I/O control block for the write stream. This oversight can lead to incorrect write stream values, causing unintended write failures when the stream is checked against maximum thresholds in the block device. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed by modifying the allocation of the asynchronous I/O command to use a safer memory allocation function that initializes the command properly. Users can apply the latest patches available in the Linux kernel stable tree to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/01f784fc9d0ab2a6dac45ee443620e517cb2a19b | kernel.org | Patch |
| https://git.kernel.org/stable/c/4eaff1728d0e69b95933412241bbccf4f797dba8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ce54802fe6bb78eb0feffc66fed6a45d41ffc3ab | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.16, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 3, 2026 | CVE Modified | kernel.org |
| May 1, 2026 | New CVE Received | kernel.org |