PT-2026-36472 · Linux · Linux

Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-43055

Mitre

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: file: Use kzalloc flex for aio cmd

The target core file doesn't initialize the aio cmd->iocb for the ki write stream. When a write command fd execute rw aio() is executed, we may get a bogus ki write stream value, causing unintended write failure status when checking iocb->ki write stream > max write streams in the block device.

Let's just use kzalloc flex when allocating the aio cmd and let ki write stream=0 to fix this issue.

Related Identifiers

CVE-2026-43055

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-43055 · Security Note
• https://git.kernel.org/stable/c/4eaff1728d0e69b95933412241bbccf4f797dba8 · Note
• https://git.kernel.org/stable/c/01f784fc9d0ab2a6dac45ee443620e517cb2a19b · Note
• https://git.kernel.org/stable/c/ce54802fe6bb78eb0feffc66fed6a45d41ffc3ab · Note