CVE-2026-44944: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-44944 is an Incorrect Authorization vulnerability in open-iscsi that allows unprivileged local users to interact with the iscssiuio control socket without proper access controls. The flaw was discovered by Keith at Linneman Labs and disclosed on July 29, 2026. It affects open-iscsi versions up to and including commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an incorrect file descriptor used when validating peer credentials on the iscsiuio control socket (CWE-863: Incorrect Authorization; CWE-1220: Insufficient Granularity of Access Control). Specifically, the mgmt_peeruser() function was called with the listening socket's file descriptor (iscsid_opts.fd) rather than the accepted connection's file descriptor (s2), meaning the credential check was performed against the wrong socket and could be bypassed by any local user. The fix, applied in commit 668ca1df, corrects the file descriptor argument and changes the error handling from break to continue so the service continues running after rejecting unauthorized connections (open-iscsi commit, Github Advisory).

Successful exploitation allows an unprivileged local user to send arbitrary commands to the iscsiuio control socket, which is normally restricted to root. This can result in unauthorized reading of sensitive iSCSI configuration data (high confidentiality impact), modification of iSCSI session or system configuration (high integrity impact), and crashing or disrupting the iscsiuio service (high availability impact). The scope is limited to the vulnerable system itself, with no direct subsequent system impact, but manipulation of iSCSI storage connections could facilitate further attacks on storage infrastructure (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires low-privilege local access to the affected system, limiting the attack surface to authenticated local users. The EPSS score is approximately 0.093% (1st percentile), indicating a low near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and NVD's SSVC assessment classifies exploitation as "none" (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a target Linux system running open-iscsi (e.g., iscsiuio process visible via ps aux) with a version at or before commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
2. Gain local access: Obtain a low-privilege shell on the target system (e.g., via SSH with a standard user account).
3. Locate the control socket: Find the iscsiuio control socket path on the filesystem (typically a Unix domain socket used for IPC between iscsid and iscsiuio).
4. Connect to the socket: Use a tool such as socat or a custom script to connect to the control socket as an unprivileged user: socat - UNIX-CONNECT:/path/to/iscsiuio.socket.
5. Bypass authorization: Due to the incorrect file descriptor used in mgmt_peeruser(), the credential check passes without validating the connecting user's identity, granting unauthorized access.
6. Send control commands: Issue privileged control commands to read iSCSI configuration, modify session parameters, or crash the service, achieving the attacker's objective (open-iscsi commit, Github Advisory).

• Logs: Unexpected or repeated entries in system logs (e.g., /var/log/messages or journalctl) showing iscsiuio connections from non-root users; absence of expected "Access error: non-administrative connection rejected" log messages when non-root users connect.
• Process: Unusual processes (e.g., socat, custom scripts) owned by unprivileged users connecting to the iscsiuio Unix domain socket.
• File System: Unexpected changes to iSCSI configuration files under /var/lib/iscsi/ or /etc/iscsi/ made outside of normal administrative activity.
• Network: Unexpected iSCSI session establishment or teardown events not initiated by administrators, observable via iscsiadm -m session output changes.

The upstream fix is available in open-iscsi commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e; users should update to a version incorporating this commit. Red Hat has issued patches for affected distributions: RHSA-2026:53845 for Red Hat Enterprise Linux 10 and RHSA-2026:53844 for Red Hat Enterprise Linux 9. As a temporary workaround prior to patching, administrators should restrict access to the iscsiuio control socket using filesystem permissions or access control lists (ACLs) to limit connections to the root user only, and audit local user accounts for unnecessary access to iSCSI-related services (Red Hat Bugzilla, Github Advisory).

Red Hat addressed the vulnerability promptly, issuing security errata for RHEL 9 and RHEL 10 within approximately two weeks of disclosure. Microsoft also published an advisory for the affected azl3_iscsi-initiator-utils package in Azure Linux 3. No significant broader community discussion or notable researcher commentary beyond the initial disclosure and vendor responses has been identified (Red Hat Bugzilla, Microsoft).