CVE-2026-63888 - Vulnerability Details

- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Two latent bugs in the Text-phase handler, both present since the
original LIO integration in commit e48354ce078c ("iscsi-target: Add
iSCSI fabric support for target v4.1"):

1) DataDigest CRC buffer overread (4 bytes past text_in).

text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then
incremented by ISCSI_CRC_LEN to make room for the received DataDigest
in the iovec, but the same (now-bumped) rx_size is passed as the
buffer length to iscsit_crc_buf():

if (conn->conn_ops->DataDigest) {
...
rx_size += ISCSI_CRC_LEN;
}
...
if (conn->conn_ops->DataDigest) {
data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);

iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so
when DataDigest is negotiated it reads 4 bytes past the end of the
text_in allocation. KASAN reproduces this directly on the unpatched
mainline tree as slab-out-of-bounds in crc32c() called from the Text
PDU path. The OOB bytes feed crc32c() and are then compared against
the initiator-supplied checksum, so the value does not flow back to
the attacker, but the kernel does read past the buffer on every Text
PDU with DataDigest=CRC32C.

Fix by passing the actual padded payload length
(ALIGN(payload_length, 4)) that was used for the kzalloc().

2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest
drop.

On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler
silently drops the PDU and lets the initiator plug the CmdSN gap:

kfree(text_in);
return 0;

cmd->text_in_ptr still points at the freed buffer. The next Text
Request on the same ITT re-enters iscsit_setup_text_cmd(), which
unconditionally does

kfree(cmd->text_in_ptr);
cmd->text_in_ptr = NULL;

freeing the same pointer a second time. Session teardown via
iscsit_release_cmd() has the same shape and hits the same double-free
if the connection is dropped before a second Text Request arrives.

On an unmodified mainline tree the bug-1 CRC overread fires first on
the initial valid Text Request and perturbs the subsequent state, so
#4 was isolated by building a kernel with only the bug-1 hunk of this
patch applied plus temporary printk() observability around the three
relevant kfree() sites. The observability prints are not part of
this patch. On that build, a three-PDU Text Request sequence after
login produces two back-to-back splats:

BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??
BUG: KASAN: double-free in iscsit_release_cmd+0x??

showing the same pointer freed in the ERL>0 drop path and again in
iscsit_setup_text_cmd() (next Text Request on the same ITT) and once
more in iscsit_release_cmd() (session teardown). On distro kernels
with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free
becomes a remote kernel BUG(); on non-hardened kernels it corrupts
the slab freelist.

Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop
path. With both hunks applied #4 is directly observable on the stock
tree without observability printks; fixing bug-1 alone would mask #4
less, not more, so the hunks are submitted together.

Both fixes are one-liners. The Text PDU state machine is unchanged and
the wire protocol is unaffected.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the iSCSI target driver of the Linux kernel, where the Text-phase handler processes Text PDUs. A CRC buffer overread allows the kernel to read four bytes beyond the allocated buffer, leading to a hazardous out-of-bounds read that can corrupt kernel state. In addition, a stale pointer freed twice triggers a double‑free, corrupting the slab freelist. Together these faults enable an attacker who can communicate with the iSCSI target to corrupt kernel memory, potentially leading to arbitrary code execution or a denial of service. The impact is captured by a CVSS score of 9.8.

Affected Systems

All Linux kernel distributions that include the iSCSI target (LIO) code and have not yet incorporated the patch are affected. The patch was introduced in the mainline kernel via several merged commits; no specific pre-patch version range is listed, so any kernel prior to the inclusion of these commits may be vulnerable. Type of vendor information is limited to Linux kernel, and no product version specifics are provided beyond this generic scope.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, reflecting a lower exploit prevalence at present. The attack vector is inferred to be remote, requiring an attacker to send malicious Text PDUs to an exposed iSCSI target; it does not require local privileges or physical access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< f7948af0dd03de84079dcd4dc215a69fd6fbb95d
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< badf178b76b0690851df00f4ca9cf2eb8eb0f963
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 6e22a1cdcc8277af4acc43710577157b77a02c5d
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< d3e9b79aa794f7a23e82de4d710e7d2df610e349
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< ec9f19d52074a191ed1756ed4a7d39fff1a2085c
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 5118ea225fe63b44207ba88047e4866e1ea43812
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 778c2ab142c625a8a8afa570e0f9b7873f445d99

Linux

affected

Version	Status	Constraints
`3.1`	affected	—
`0`	unaffected	< 3.1
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e48354ce078c079996f89d715dfa44814b4eba01,f7948af0dd03de84079dcd4dc215a69fd6fbb95d)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,badf178b76b0690851df00f4ca9cf2eb8eb0f963)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,6e22a1cdcc8277af4acc43710577157b77a02c5d)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,d3e9b79aa794f7a23e82de4d710e7d2df610e349)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,ec9f19d52074a191ed1756ed4a7d39fff1a2085c)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,5118ea225fe63b44207ba88047e4866e1ea43812)`	affected	code_commit	—
`[e48354ce078c079996f89d715dfa44814b4eba01,778c2ab142c625a8a8afa570e0f9b7873f445d99)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.1`	affected	generic	—
`[0,3.1)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the most recent release that incorporates the commits referenced in the advisory (e.g., apply these kernel patches or install a distribution kernel that has merged them).
If a kernel upgrade cannot be performed immediately, disable or tightly restrict the iSCSI target service so that only trusted hosts can communicate with it, thereby limiting the opportunity for an attacker to send malicious PDUs.
As a temporary workaround, disable the DataDigest option in the iSCSI target configuration to eliminate the CRC overread path until a definitive patch is applied.

Generated by OpenCVE AI on August 3, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00745.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812
https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d
https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99
https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3
https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963
https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349
https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c
https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d
https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63888
https://www.cve.org/CVERecord?id=CVE-2026-63888

History

Wed, 29 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-126 CWE-416

Wed, 22 Jul 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-126 CWE-416

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63888 https://www.cve.org/CVERecord?id=CVE-2026-63888
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0; cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL; freeing the same pointer a second time. Session teardown via iscsit_release_cmd() has the same shape and hits the same double-free if the connection is dropped before a second Text Request arrives. On an unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch applied plus temporary printk() observability around the three relevant kfree() sites. The observability prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces two back-to-back splats: BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? BUG: KASAN: double-free in iscsit_release_cmd+0x?? showing the same pointer freed in the ERL>0 drop path and again in iscsit_setup_text_cmd() (next Text Request on the same ITT) and once more in iscsit_release_cmd() (session teardown). On distro kernels with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free becomes a remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist. Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not more, so the hunks are submitted together. Both fixes are one-liners. The Text PDU state machine is unchanged and the wire protocol is unaffected.
Title		scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812 https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99 https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3 https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963 https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349 https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:00.803Z

Updated: 2026-08-05T12:36:57.546Z

Reserved: 2026-07-19T07:54:57.018Z

Link: CVE-2026-63888

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63888 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T02:30:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object