PT-2026-61204 · Linux · Linux

CVE-2026-63887

·

Published

2026-07-19

·

Updated

2026-07-19

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Bound iscsi encode text output() appends to rsp buf
iscsi encode text output() concatenates "key=value0" records into login->rsp buf, an 8192-byte kzalloc(MAX KEY VALUE PAIRS) buffer allocated in iscsit alloc login setup buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity:
*length += sprintf(output buf, "%s=%s", er->key, er->value);
*length += 1;
output buf = textbuf + *length;
The 8192-byte ceiling at iscsi target check login request() bounds the input Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood0" output record via iscsi add notunderstood response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab.
The fix introduces a static iscsi encode text record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf size parameter through iscsi encode text output(). Both call sites in iscsi target handle csg zero() (PHASE SECURITY) and iscsi target handle csg one() (PHASE OPERATIONAL) pass MAX KEY VALUE PAIRS. On overflow the encoder logs the condition, calls iscsi release extra responses() to drop queued records, and returns -1; both caller sites now emit ISCSI STATUS CLS INITIATOR ERR / ISCSI LOGIN STATUS INIT ERR via iscsit tx login rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE OPERATIONAL caller did that; the PHASE SECURITY caller is converted to the same shape.)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-63887

Affected Products

Linux