{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-63888", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.018Z", "datePublished": "2026-07-19T14:55:00.803Z", "dateUpdated": "2026-08-05T12:36:57.546Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:57.546Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n in the iovec, but the same (now-bumped) rx_size is passed as the\n buffer length to iscsit_crc_buf():\n\n if (conn->conn_ops->DataDigest) {\n ...\n rx_size += ISCSI_CRC_LEN;\n }\n ...\n if (conn->conn_ops->DataDigest) {\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n when DataDigest is negotiated it reads 4 bytes past the end of the\n text_in allocation. KASAN reproduces this directly on the unpatched\n mainline tree as slab-out-of-bounds in crc32c() called from the Text\n PDU path. The OOB bytes feed crc32c() and are then compared against\n the initiator-supplied checksum, so the value does not flow back to\n the attacker, but the kernel does read past the buffer on every Text\n PDU with DataDigest=CRC32C.\n\n Fix by passing the actual padded payload length\n (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest\n drop.\n\n On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler\n silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n kfree(text_in);\n return 0;\n\n cmd->text_in_ptr still points at the freed buffer. The next Text\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n unconditionally does\n\n kfree(cmd->text_in_ptr);\n cmd->text_in_ptr = NULL;\n\n freeing the same pointer a second time. Session teardown via\n iscsit_release_cmd() has the same shape and hits the same double-free\n if the connection is dropped before a second Text Request arrives.\n\n On an unmodified mainline tree the bug-1 CRC overread fires first on\n the initial valid Text Request and perturbs the subsequent state, so\n #4 was isolated by building a kernel with only the bug-1 hunk of this\n patch applied plus temporary printk() observability around the three\n relevant kfree() sites. The observability prints are not part of\n this patch. On that build, a three-PDU Text Request sequence after\n login produces two back-to-back splats:\n\n BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n showing the same pointer freed in the ERL>0 drop path and again in\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n more in iscsit_release_cmd() (session teardown). On distro kernels\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n the slab freelist.\n\n Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop\n path. With both hunks applied #4 is directly observable on the stock\n tree without observability printks; fixing bug-1 alone would mask #4\n less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners. The Text PDU state machine is unchanged and\nthe wire protocol is unaffected." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/target/iscsi/iscsi_target.c" ], "versions": [ { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "f7948af0dd03de84079dcd4dc215a69fd6fbb95d", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "badf178b76b0690851df00f4ca9cf2eb8eb0f963", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "6e22a1cdcc8277af4acc43710577157b77a02c5d", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "d3e9b79aa794f7a23e82de4d710e7d2df610e349", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "ec9f19d52074a191ed1756ed4a7d39fff1a2085c", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "5118ea225fe63b44207ba88047e4866e1ea43812", "status": "affected", "versionType": "git" }, { "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "778c2ab142c625a8a8afa570e0f9b7873f445d99", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/target/iscsi/iscsi_target.c" ], "versions": [ { "version": "3.1", "status": "affected" }, { "version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.10.259" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.15.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.176" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6.143" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.12.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.18.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.0.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d" }, { "url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963" }, { "url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d" }, { "url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349" }, { "url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c" }, { "url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3" }, { "url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812" }, { "url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99" } ], "title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()", "x_generator": { "engine": "bippy-1.2.0" } } } }