The Linux kernel contains a buffer overflow in the iSCSI target’s CHAP authentication path. When processing a CHAP_R response, the kernel allocates a digest buffer sized for the expected SHA‑256 or MD5 hash but then decodes the Base64‑encoded value without first confirming that the decoded data will fit. Because a malformed Base64 string can produce up to 95 bytes of output, the write overruns the buffer by 63 or 79 bytes, corrupting kernel memory. An attacker who can supply a crafted CHAP_R string can trigger this overflow and gain control of kernel execution, allowing arbitrary code execution with elevated privileges.

All Linux kernel builds that include the iSCSI target module are susceptible unless they contain the patch that adds a length check before Base64 decoding. This includes standard distributions that ship the default kernel with an enabled iSCSI target; any kernel version lacking the commit that introduces the validation logic is at risk.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is below 1 %, suggesting limited current exploitation activity. It is not listed in the CISA KEV catalog. Exploitation requires a network connection to a host running the vulnerable iSCSI target and the ability to deliver a specially crafted CHAP_R value during authentication. If successful, the overflow can be leveraged to overwrite control data in the kernel, enabling remote code execution.