CVE-2026-63887

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

iscsi_encode_text_output() concatenates "key=value\0" records into

login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer

allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call

sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check

the remaining buffer capacity:

*length += sprintf(output_buf, "%s=%s", er->key, er->value);

*length += 1;

output_buf = textbuf + *length;

The 8192-byte ceiling at iscsi_target_check_login_request() bounds the

*input* Login PDU payload, but a single PDU can carry up to 2048 minimal

four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte

"a=NotUnderstood\0" output record via iscsi_add_notunderstood_response().

2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB

heap overrun in the kmalloc-8k slab.

The fix introduces a static iscsi_encode_text

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References