CVE-2026-63887 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity:
*length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length;
The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab.
The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the Linux kernel's iSCSI target implementation where a heap buffer overflow occurs during login request processing. This flaw manifests in the `iscsi_encode_text_output()` function which handles encoding key-value pairs for iSCSI login responses. The function concatenates formatted strings into a fixed 8192-byte buffer allocated via `kzalloc(MAX_KEY_VALUE_PAIRS)` without performing capacity checks before each append operation.
The technical flaw stems from three `sprintf()` invocations within the function that blindly write to the response buffer without verifying remaining space. Each key-value pair is formatted as "key=value\0" with a fixed size of four bytes minimum, but when processing login requests containing numerous key-value pairs, the system encounters a critical issue during response generation. The `iscsi_target_check_login_request()` function enforces an 8192-byte limit on input PDU payloads, yet the output processing can generate significantly larger responses.
During normal operation, each minimal "a=b\0" input pair can expand into a 16-byte "a=NotUnderstood\0" output record when keys are not recognized by the target. This expansion factor of four, combined with the potential for up to 2048 key-value pairs per PDU, creates an output volume of approximately 32 KiB. The original 8 KiB buffer capacity becomes insufficient, resulting in a heap overflow of roughly 24 KiB within the kmalloc-8k slab allocation.
This vulnerability directly maps to CWE-121 Heap-based Buffer Overflow and aligns with ATT&CK technique T1059.007 for command and scripting interpreter usage. The condition creates a potential for arbitrary code execution through memory corruption, as heap overflows can allow attackers to manipulate program flow or inject malicious payloads. The system's failure to validate buffer boundaries before string operations represents a classic security weakness in memory management.
The mitigation strategy involves implementing a bounded encoding helper function `iscsi_encode_text_record()` that utilizes `snprintf()` with per-call capacity validation against the remaining buffer space. This approach addresses the root cause by ensuring that each write operation respects available buffer capacity. The solution introduces a `textbuf_size` parameter to track buffer limits throughout the encoding process, passing `MAX_KEY_VALUE_PAIRS` from both calling contexts within `iscsi_target_handle_csg_zero()` and `iscsi_target_handle_csg_one()`.
When overflow conditions occur, the enhanced encoder logs the violation, releases queued response records via `iscsi_release_extra_responses()`, and returns an error code of -1. Both caller sites now properly handle error conditions by transmitting explicit failure responses to initiators through `iscsit_tx_login_rsp()` using `ISCSI_STATUS_CLS_INITIATOR_ERR` or `ISCSI_LOGIN_STATUS_INIT_ERR` status codes instead of allowing silent connection termination. This change ensures that initiators receive clear feedback about login failures rather than experiencing unexpected disconnections, improving both security and system reliability. The fix maintains backward compatibility while preventing the heap corruption that could otherwise enable privilege escalation or denial-of-service conditions.