CVE-2026-63887
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the corrected version.
- Apply the vendor-provided patch.
- Verify the fix by testing.
- Monitor system logs for related errors.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63887.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63887 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63887
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63887 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63887 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'cb84e974fb172bc71386289f37b78ea679410b39', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'b19382dfc6e7dee6d3859ba44b6ca29e97a51627', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'efe633e600a0ac68357206fede21b1ac8178f3b8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '4e9f0c4a645c995bc75c06c7b3644254ffb4c76b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '30bf335e8fe170322080ee001f05ca29c50680b3', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '594a40360012ce5f94c715d5e3b20fa3af7d525a', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '26e4a304b7e6f1338c675d527608d32549c091db', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'bf33e01f88388c43e285492a63e539df6ffed64c', 'versionType': 'git'}], 'programFiles': ['drivers/target/iscsi/iscsi_target_nego.c', 'drivers/target/iscsi/iscsi_target_parameters.c', 'drivers/target/iscsi/iscsi_target_parameters.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/target/iscsi/iscsi_target_nego.c', 'drivers/target/iscsi/iscsi_target_parameters.c', 'drivers/target/iscsi/iscsi_target_parameters.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.) Added Reference https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db Added Reference https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3 Added Reference https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b Added Reference https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a Added Reference https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627 Added Reference https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c Added Reference https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39 Added Reference https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8