CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.8-1Fixed in 7.2.9-1 - Compensating control
Pass the actual padded payload length, ALIGN(payload_length, 4), to iscsit_crc_buf() so CRC processing matches the text_in allocation length.
- Compensating control
After kfree() in the ErrorRecoveryLevel > 0 drop path, clear cmd->text_in_ptr by assigning NULL to prevent subsequent double-free in iscsit_setup_text_cmd() or iscsit_release_cmd().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63888?
The severity of CVE-2026-63888 is critical with a score of 9.8.
How do I fix CVE-2026-63888?
To fix CVE-2026-63888, update the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2026-63888?
CVE-2026-63888 affects the Linux kernel, specifically implementations using the iSCSI target functionality.
What types of attacks can exploit CVE-2026-63888?
CVE-2026-63888 can be exploited remotely, allowing attackers to cause data corruption and denial-of-service conditions.
What are the consequences of not addressing CVE-2026-63888?
If not addressed, CVE-2026-63888 may lead to severe data integrity issues and system instability.