CVE-2026-63887 - Vulnerability Details

- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

iscsi_encode_text_output() concatenates "key=value\0" records into
login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer
allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call
sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check
the remaining buffer capacity:

*length += sprintf(output_buf, "%s=%s", er->key, er->value);
*length += 1;
output_buf = textbuf + *length;

The 8192-byte ceiling at iscsi_target_check_login_request() bounds the
*input* Login PDU payload, but a single PDU can carry up to 2048 minimal
four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte
"a=NotUnderstood\0" output record via iscsi_add_notunderstood_response().
2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB
heap overrun in the kmalloc-8k slab.

The fix introduces a static iscsi_encode_text_record() helper that uses
snprintf() with a per-call bounds check against the remaining buffer,
and threads a u32 textbuf_size parameter through
iscsi_encode_text_output(). Both call sites in
iscsi_target_handle_csg_zero() (PHASE_SECURITY) and
iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass
MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls
iscsi_release_extra_responses() to drop queued records, and returns -1;
both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /
ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,
so the initiator sees an explicit failed-login response rather than a
silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL
caller did that; the PHASE_SECURITY caller is converted to the same
shape.)

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a heap-based buffer overflow in the Linux kernel’s iSCSI target code. The iscsi_encode_text_output() routine concatenates key‑value pairs into an 8‑KiB buffer without checking remaining space, allowing a crafted login PDU to produce up to 32‑KiB of output and corrupt heap memory. The overflow could lead to arbitrary code execution in the kernel, providing an attacker full control over the system.

Affected Systems

Affected systems are Linux kernel installations that have not yet incorporated the patched iscsi_encode_text_output() routine. This includes any kernel variant that uses the legacy iSCSI target implementation prior to the commit that added bounds checking. The CNA list identifies Linux:Linux as the vendor, and the CPE confirms affected kernels.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity, and the EPSS score of less than 1% suggests low current exploitation probability, though the vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by sending a specially crafted iSCSI login PDU from the network to the target, a vector that is inferred from the description of how the overflow occurs during login processing.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< cb84e974fb172bc71386289f37b78ea679410b39
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< b19382dfc6e7dee6d3859ba44b6ca29e97a51627
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< efe633e600a0ac68357206fede21b1ac8178f3b8
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 4e9f0c4a645c995bc75c06c7b3644254ffb4c76b
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 30bf335e8fe170322080ee001f05ca29c50680b3
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 594a40360012ce5f94c715d5e3b20fa3af7d525a
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 26e4a304b7e6f1338c675d527608d32549c091db
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< bf33e01f88388c43e285492a63e539df6ffed64c

Linux

affected

Version	Status	Constraints
`3.1`	affected	—
`0`	unaffected	< 3.1
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e48354ce078c079996f89d715dfa44814b4eba01,cb84e974fb172bc71386289f37b78ea679410b39)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,b19382dfc6e7dee6d3859ba44b6ca29e97a51627)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,efe633e600a0ac68357206fede21b1ac8178f3b8)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,4e9f0c4a645c995bc75c06c7b3644254ffb4c76b)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,30bf335e8fe170322080ee001f05ca29c50680b3)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,594a40360012ce5f94c715d5e3b20fa3af7d525a)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,26e4a304b7e6f1338c675d527608d32549c091db)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,bf33e01f88388c43e285492a63e539df6ffed64c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.1`	affected	generic	—
`[0,3.1)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the iscsi_encode_text_output bounds‑check patch
If an update is not available, block iSCSI traffic from untrusted networks or disable the iSCSI target service until patched
Monitor kernel logs for signs of buffer overrun or anomalous iSCSI login attempts, and be prepared to restart the system if instability occurs

Generated by OpenCVE AI on August 4, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00745.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db
https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3
https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b
https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a
https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627
https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c
https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39
https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8
https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63887-cf4b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63887
https://www.cve.org/CVERecord?id=CVE-2026-63887

History

Sat, 25 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122 CWE-787

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63887-cf4b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63887 https://www.cve.org/CVERecord?id=CVE-2026-63887
Metrics	threat_severity `None`	threat_severity `Important`

Wed, 22 Jul 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122 CWE-787

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: length += sprintf(output_buf, "%s=%s", er->key, er->value); length += 1; output_buf = textbuf + length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)
Title		scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3 https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627 https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39 https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:00.114Z

Updated: 2026-08-05T12:36:56.451Z

Reserved: 2026-07-19T07:54:57.018Z

Link: CVE-2026-63887

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63887 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T07:00:05Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object