Projeto tgt tgt · Disclosed

[Single source] tgt 1.0.98 silently fixes write, leak and CHAP overflow

Nov 09, 2026 · 1 min read

The tgt daemon, the Linux SCSI/iSCSI target, released version 1.0.98 with silent fixes for three flaws: a memory write primitive, a leak primitive, and a buffer overflow in CHAP base64 handling. No CVE or advisory was issued, and researcher bl4sty says his public report received no attribution. No exploitation is reported; administrators should upgrade to 1.0.98.

By HIFY Radar newsroom Updated 11/09/2026 11:01 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In 30 seconds

Alleged

Linux iSCSI target daemon tgt has shipped version 1.0.98 with three security-relevant fixes applied without announcement: a write primitive addressed in commit e3b418a, a leak primitive in commit a3f4a25, and a CHAP base64 overflow in commit 094ade2. According to the researcher who reported the flaws, there is no CVE, no advisory, and no attribution to the public report that preceded the release.

Observed

The silent fixes come roughly two weeks after security researcher bl4sty published a loud public warning about a Linux iSCSI tgt RCE 0day, urging users to get their networked block devices off the internet immediately.

What happened

Observed

On October 28, 2026, bl4sty posted an all-caps 'HIGH COUNCIL ANNOUNCEMENT' on X flagging a Linux iSCSI tgt RCE 0day, linking to a report and telling followers to 'REMOVE YOUR NETWORKED BLOCK DEVICEZ FROM THE INTERNET BEFORE IT'S 2L8!@#$'.

Observed

On November 9, 2026, the same researcher reported that tgt v1.0.98 had been released with the write primitive (e3b418a), the leak primitive (a3f4a25) and the CHAP base64 overflow (094ade2) 'silently fixed', noting the absence of a CVE, an advisory, or attribution to the public report.

Why it matters

Alleged

tgt is the iSCSI target daemon used to serve block storage over networks; the original warning framed the reported flaw as a remote code execution 0day, meaning internet-exposed storage targets were the highest-risk population.

Inferred

Shipping the fixes silently, with no CVE and no advisory, weakens defenders' ability to prioritize patching: vulnerability-driven triage and compliance workflows that key off CVE identifiers will not surface these commits, and the researcher's complaint about missing attribution suggests the disclosure credit was skipped entirely.

What to do

Inferred

Operators running tgt should upgrade to v1.0.98 as soon as possible, since the release contains fixes for the three reported flaws.

Inferred

Consistent with the original warning, iSCSI and other block-storage services should not be reachable from the internet; restrict tgt to trusted networks and firewall the iSCSI ports until the upgrade is verified.

Confirmed and still uncertain

Alleged

Known: v1.0.98 is out; three flaws were fixed, keyed to commits e3b418a (write primitive), a3f4a25 (leak primitive) and 094ade2 (CHAP base64 overflow); a public report preceded the fixes by about twelve days.

Inferred

Unknown from the available evidence: CVE identifiers, any vendor advisory, the affected version range, exploit or proof-of-concept details, whether exploitation in the wild has been observed, and whether the three fixes fully remediate the RCE described in the report.

What people are saying

Observed

The only voice in the evidence is bl4sty, whose tone shifted from theatrical alarm ('HIGH COUNCIL ANNOUNCEMENT', 'REMOVE YOUR NETWORKED BLOCK DEVICEZ') to dry resignation: 'no CVE, no advisory, no attribution to this (public) report ;^(': the trailing emoticon signaling frustration at the silent, uncredited fix.

Evolution

Observed

Timeline of the episode: October 28, 2026: bl4sty announces the tgt RCE 0day report and urges immediate removal of exposed block devices; November 9, 2026: tgt v1.0.98 lands with the write, leak and CHAP base64 fixes merged quietly, roughly twelve days after the warning.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The three fixed issues map to specific commits: e3b418a for the write primitive, a3f4a25 for the leak primitive, and 094ade2 for the CHAP base64 overflow: the last indicating a memory-safety bug in the base64 handling of CHAP, the authentication protocol used by iSCSI initiators and targets.

Inferred

The pairing of a 'leak prim' and a 'write prim' in the fix list suggests the report described a classic exploitation chain: an information-leak primitive (for example, to defeat address randomization) combined with a memory-write primitive for control-flow hijack: which is consistent with the RCE classification in the original warning.

Sources and evidence

Observed

Evidence base: two X posts by @bl4sty: the 2026-10-28 announcement of the tgt RCE 0day report (https://x.com/bl4sty/status/2115394170428723523) and the 2026-11-09 note that v1.0.98 silently fixed the write, leak and CHAP base64 flaws (https://x.com/bl4sty/status/2119792063302791538).

Inferred

Limitations: single-source, social-media-only evidence. The commit hashes, the release contents, and the absence of CVE/advisory/attribution are the researcher's assertions and have not been independently verified against the upstream repository, distro advisories, or CVE databases within this evidence batch.