CVE-2026-63888

Status: UPDATED  |  Advisory ID: CVE-2026-63888

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Two latent bugs in the Text-phase handler, both present since the

original LIO integration in commit e48354ce078c ("iscsi-target: Add

iSCSI fabric support for target v4.1"):

1) DataDigest CRC buffer overread (4 bytes past text_in).

text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then

incremented by ISCSI_CRC_LEN to make room for the received DataDigest

in the iovec, but the same (now-bumped) rx_size is passed as the

buffer length to iscsit_crc_buf():

if (conn->conn_ops->DataDigest) {

...

rx_size += ISCSI_CRC_LEN;

}

...

if (conn->conn_ops->DataDigest) {

data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);

iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so

when DataDigest is negotiated it reads 4 bytes past the end of the

text_in allocation. KASAN reproduces this directly on the unpatched

mainline tree as slab-out-of-bounds in crc32c() called from the Text

PDU path. The OOB bytes feed crc32c() and are then compared against

the initiator-supplied checksum, so the value does not flow back to

the attacker, but the kernel does read past the buffer on every Text

PDU with DataDigest=CRC32C.

Fix by passing the actual padded payload length

(ALIGN(payload_length, 4)) that was used for the kzalloc().

2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest

drop.

On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler

silently drops the PDU and lets the initiator plug the CmdSN gap:

kfree(text_in);

return 0;

cmd->text_in_ptr still points at the freed buffer. The next Text

Request on the same ITT re-enters iscsit_setup_text_cmd(), which

unconditionally does

kfree(cmd->text_in_ptr);

cmd->text_in_ptr = NULL;

freeing the same pointer a second time. Session teardown via

iscsit_release_cmd() has the same shape and hits the same double-free

if the connection is dropped before a second Text Request arrives.

On an unmodified mainline tree the bug-1 CRC overread fires first on

the initial valid Text Request and perturbs the subsequent state, so

#4 was isolated by building a kernel with only the bug-1 hunk of this

patch applied plus temporary printk() observability around the three

relevant kfree() sites. The observability prints are not part of

this patch. On that build, a three-PDU Text Request sequence after

login produces two back-to-back splats:

BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??

BUG: KASAN: double-free in iscsit_release_cmd+0x??

showing the same pointer freed in the ERL>0 drop path and again in

iscsit_setup_text_cmd() (next Text Request on the same ITT) and once

more in iscsit_release_cmd() (session teardown). On distro kernels

with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free

becomes a remote kernel BUG(); on non-hardened kernels it corrupts

the slab freelist.

Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop

path. With both hunks applied #4 is directly observable on the stock

tree without observability printks; fixing bug-1 alone would mask #4

less, not more, so the hunks are submitted together.

Both fixes are one-liners. The Text PDU state machine is unchanged and

the wire protocol is unaffected. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References