9.8
CRITICAL CVSS 3.1
CVE-2026-63887
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)

INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 27, 2026, 5:44 p.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-63887 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Apply the Linux kernel patch to fix heap overflow in iscsi_encode_text_output by using snprintf and bounds checking.
  • Update the Linux kernel to the corrected version.
  • Apply the vendor-provided patch.
  • Verify the fix by testing.
  • Monitor system logs for related errors.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-63887 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-63887 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-63887 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-63887 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 20, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'cb84e974fb172bc71386289f37b78ea679410b39', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'b19382dfc6e7dee6d3859ba44b6ca29e97a51627', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'efe633e600a0ac68357206fede21b1ac8178f3b8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '4e9f0c4a645c995bc75c06c7b3644254ffb4c76b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '30bf335e8fe170322080ee001f05ca29c50680b3', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '594a40360012ce5f94c715d5e3b20fa3af7d525a', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': '26e4a304b7e6f1338c675d527608d32549c091db', 'versionType': 'git'}, {'status': 'affected', 'version': 'e48354ce078c079996f89d715dfa44814b4eba01', 'lessThan': 'bf33e01f88388c43e285492a63e539df6ffed64c', 'versionType': 'git'}], 'programFiles': ['drivers/target/iscsi/iscsi_target_nego.c', 'drivers/target/iscsi/iscsi_target_parameters.c', 'drivers/target/iscsi/iscsi_target_parameters.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/target/iscsi/iscsi_target_nego.c', 'drivers/target/iscsi/iscsi_target_parameters.c', 'drivers/target/iscsi/iscsi_target_parameters.h'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)
    Added Reference https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db
    Added Reference https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3
    Added Reference https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b
    Added Reference https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a
    Added Reference https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627
    Added Reference https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c
    Added Reference https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39
    Added Reference https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.