{
  "threat_severity" : "Important",
  "public_date" : "2026-07-19T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()",
    "id" : "2502443",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2502443"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n1) DataDigest CRC buffer overread (4 bytes past text_in).\ntext_in is kzalloc()'d at ALIGN(payload_length, 4).  rx_size is then\nincremented by ISCSI_CRC_LEN to make room for the received DataDigest\nin the iovec, but the same (now-bumped) rx_size is passed as the\nbuffer length to iscsit_crc_buf():\nif (conn->conn_ops->DataDigest) {\n...\nrx_size += ISCSI_CRC_LEN;\n}\n...\nif (conn->conn_ops->DataDigest) {\ndata_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\niscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\nwhen DataDigest is negotiated it reads 4 bytes past the end of the\ntext_in allocation.  KASAN reproduces this directly on the unpatched\nmainline tree as slab-out-of-bounds in crc32c() called from the Text\nPDU path.  The OOB bytes feed crc32c() and are then compared against\nthe initiator-supplied checksum, so the value does not flow back to\nthe attacker, but the kernel does read past the buffer on every Text\nPDU with DataDigest=CRC32C.\nFix by passing the actual padded payload length\n(ALIGN(payload_length, 4)) that was used for the kzalloc().\n2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest\ndrop.\nOn DataDigest mismatch with ErrorRecoveryLevel > 0 the handler\nsilently drops the PDU and lets the initiator plug the CmdSN gap:\nkfree(text_in);\nreturn 0;\ncmd->text_in_ptr still points at the freed buffer.  The next Text\nRequest on the same ITT re-enters iscsit_setup_text_cmd(), which\nunconditionally does\nkfree(cmd->text_in_ptr);\ncmd->text_in_ptr = NULL;\nfreeing the same pointer a second time.  Session teardown via\niscsit_release_cmd() has the same shape and hits the same double-free\nif the connection is dropped before a second Text Request arrives.\nOn an unmodified mainline tree the bug-1 CRC overread fires first on\nthe initial valid Text Request and perturbs the subsequent state, so\n#4 was isolated by building a kernel with only the bug-1 hunk of this\npatch applied plus temporary printk() observability around the three\nrelevant kfree() sites.  The observability prints are not part of\nthis patch.  On that build, a three-PDU Text Request sequence after\nlogin produces two back-to-back splats:\nBUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\nBUG: KASAN: double-free in iscsit_release_cmd+0x??\nshowing the same pointer freed in the ERL>0 drop path and again in\niscsit_setup_text_cmd() (next Text Request on the same ITT) and once\nmore in iscsit_release_cmd() (session teardown).  On distro kernels\nwith CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\nbecomes a remote kernel BUG(); on non-hardened kernels it corrupts\nthe slab freelist.\nFix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop\npath.  With both hunks applied #4 is directly observable on the stock\ntree without observability printks; fixing bug-1 alone would mask #4\nless, not more, so the hunks are submitted together.\nBoth fixes are one-liners.  The Text PDU state machine is unchanged and\nthe wire protocol is unaffected.", "A flaw was found in the Linux kernel's iSCSI (Internet Small Computer System Interface) target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network packets, leading to a kernel crash or memory corruption. This could result in a Denial of Service (DoS) for the affected system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57251",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.49.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57254",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.157.1.rt7.498.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57253",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.157.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59473",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.6",
    "package" : "kernel-0:4.18.0-372.208.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59473",
    "cpe" : "cpe:/o:redhat:rhel_eus_long_life:8.6",
    "package" : "kernel-0:4.18.0-372.208.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-63888\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63888\nhttps://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T" ],
  "name" : "CVE-2026-63888",
  "csaw" : false
}