scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with Error
CVE-2026-63888
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63888
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "f7948af0dd03de84079dcd4dc215a69fd6fbb95d",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "badf178b76b0690851df00f4ca9cf2eb8eb0f963",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "6e22a1cdcc8277af4acc43710577157b77a02c5d",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "d3e9b79aa794f7a23e82de4d710e7d2df610e349",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "ec9f19d52074a191ed1756ed4a7d39fff1a2085c",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "5118ea225fe63b44207ba88047e4866e1ea43812",
"versionType": "git"
},
{
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"lessThan": "778c2ab142c625a8a8afa570e0f9b7873f445d99",
"versionType": "git"
}
],
"programFiles": [
"drivers/target/iscsi/iscsi_target.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/target/iscsi/iscsi_target.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-63888
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #40886 · Revision 1
- Added to Heist Feed
- Publisher date