PT-2026-61205 · Linux · Linux

CVE-2026-63888

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix CRC overread and double-free in iscsit handle text cmd()
Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"):
  1. DataDigest CRC buffer overread (4 bytes past text in).
text in is kzalloc()'d at ALIGN(payload length, 4). rx size is then incremented by ISCSI CRC LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx size is passed as the buffer length to iscsit crc buf():
if (conn->conn ops->DataDigest) {
    ...
    rx size += ISCSI CRC LEN;
}
...
if (conn->conn ops->DataDigest) {
    data crc = iscsit crc buf(text in, rx size, 0, NULL);
iscsit crc buf() walks rx size bytes of text in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C.
Fix by passing the actual padded payload length (ALIGN(payload length, 4)) that was used for the kzalloc().
  1. Stale cmd->text in ptr re-free (double-free) on ERL>0 bad DataDigest drop.
On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler silently drops the PDU and lets the initiator plug the CmdSN gap:
    kfree(text in);
    return 0;
cmd->text in ptr still points at the freed buffer. The next Text Request on the same ITT re-enters iscsit setup text cmd(), which unconditionally does
kfree(cmd->text in ptr);
cmd->text in ptr = NULL;
freeing the same pointer a second time. Session teardown via iscsit release cmd() has the same shape and hits the same double-free if the connection is dropped before a second Text Request arrives.
On an unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch applied plus temporary printk() observability around the three relevant kfree() sites. The observability prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces two back-to-back splats:
BUG: KASAN: double-free in iscsit setup text cmd+0x??
BUG: KASAN: double-free in iscsit release cmd+0x??
showing the same pointer freed in the ERL>0 drop path and again in iscsit setup text cmd() (next Text Request on the same ITT) and once more in iscsit release cmd() (session teardown). On distro kernels with CONFIG SLAB FREELIST HARDENED=y (default) the double-free becomes a remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist.
Fix by clearing cmd->text in ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not more, so the hunks are submitted together.
Both fixes are one-liners. The Text PDU state machine is unchanged and the wire protocol is unaffected.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-63888

Produtos afetados

Linux