Bug 2482566 (CVE-2026-46149) - CVE-2026-46149 kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
Summary: CVE-2026-46149 kernel: scsi: target: configfs: Bound snprintf() return in tg_...
Keywords:
Status: NEW
Alias: CVE-2026-46149
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-28 11:03 UTC by OSIDB Bzimport
Modified: 2026-11-04 08:19 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:66180 0 None None None 2026-09-09 22:05:10 UTC
Red Hat Product Errata RHSA-2026:66324 0 None None None 2026-09-10 05:18:34 UTC
Red Hat Product Errata RHSA-2026:66325 0 None None None 2026-09-10 05:39:53 UTC
Red Hat Product Errata RHSA-2026:67471 0 None None None 2026-09-15 06:14:25 UTC
Red Hat Product Errata RHSA-2026:79783 0 None None None 2026-10-09 08:58:08 UTC
Red Hat Product Errata RHSA-2026:83707 0 None None None 2026-10-16 13:30:23 UTC
Red Hat Product Errata RHSA-2026:84677 0 None None None 2026-10-19 05:47:56 UTC
Red Hat Product Errata RHSA-2026:84793 0 None None None 2026-10-19 10:52:25 UTC
Red Hat Product Errata RHSA-2026:91489 0 None None None 2026-10-28 01:09:57 UTC
Red Hat Product Errata RHSA-2026:91492 0 None None None 2026-10-28 01:14:25 UTC
Red Hat Product Errata RHSA-2026:92993 0 None None None 2026-10-30 06:30:58 UTC
Red Hat Product Errata RHSA-2026:93047 0 None None None 2026-10-30 13:05:40 UTC

Description OSIDB Bzimport 2026-05-28 11:03:35 UTC 
In the Linux kernel, the following vulnerability has been resolved:

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a
256-byte stack buffer, then will memcpy() cur_len bytes from that
buffer.  snprintf() returns the length the output would have had, which
can exceed the buffer size when the fabric WWN is long because iSCSI IQN
names can be up to 223 bytes.  The check at the memcpy() site only
guards the destination page write, not the source read, so memcpy() will
read past the stack buffer and copy adjacent stack contents to the sysfs
reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()
will be triggered.

Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length
check to avoid buffer overflow") added the same bound to the
target_lu_gp_members_show() but the tg_pt_gp variant was missed so
resolve that here.
Comment 1 Keith Grant 2026-05-28 16:23:47 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46149-ad2e@gregkh/T
Comment 3 errata-xmlrpc 2026-09-09 22:05:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:66180 https://access.redhat.com/errata/RHSA-2026:66180
Comment 4 errata-xmlrpc 2026-09-10 05:18:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66324 https://access.redhat.com/errata/RHSA-2026:66324
Comment 5 errata-xmlrpc 2026-09-10 05:39:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66325 https://access.redhat.com/errata/RHSA-2026:66325
Comment 6 Jon Orris 2026-09-15 06:14:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:67471 https://access.redhat.com/errata/RHSA-2026:67471
Comment 8 Jon Orris 2026-10-09 08:58:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:79783 https://access.redhat.com/errata/RHSA-2026:79783
Comment 9 Jon Orris 2026-10-16 13:30:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:83707 https://access.redhat.com/errata/RHSA-2026:83707
Comment 10 Jon Orris 2026-10-19 05:47:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:84677 https://access.redhat.com/errata/RHSA-2026:84677
Comment 11 Jon Orris 2026-10-19 10:52:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:84793 https://access.redhat.com/errata/RHSA-2026:84793
Comment 13 Jon Orris 2026-10-28 01:09:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:91489 https://access.redhat.com/errata/RHSA-2026:91489
Comment 14 Jon Orris 2026-10-28 01:14:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:91492 https://access.redhat.com/errata/RHSA-2026:91492
Comment 15 Jon Orris 2026-10-30 06:30:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92993 https://access.redhat.com/errata/RHSA-2026:92993
Comment 16 Jon Orris 2026-10-30 13:05:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:93047 https://access.redhat.com/errata/RHSA-2026:93047
Note You need to log in before you can comment on or make changes to this bug.