CVE-2026-63888

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Two latent bugs in the Text-phase handler, both present since the

original LIO integration in commit e48354ce078c ("iscsi-target: Add

iSCSI fabric support for target v4.1"):

1) DataDigest CRC buffer overread (4 bytes past text_in).

text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then

incremented by ISCSI_CRC_LEN to make room for the received DataDigest

in the iovec, but the same (now-bumped) rx_size is passed as the

buffer length to iscsit_crc_buf():

if (conn->conn_ops->DataDigest) {

...

rx_size += ISCSI_CRC_LEN;

}

...

if (conn->conn_ops->DataDigest) {

data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);

iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so

when DataDigest is negotiated it reads 4 bytes past the en

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References