CVE-2026-63888

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Two bugs exist in the Text-phase handler of the iSCSI target. The first issue is a buffer overread where the iscsit crc buf() function reads 4 bytes past the end of the text in buffer when DataDigest is negotiated. This occurs because the rx size variable is incremented by ISCSI CRC LEN before being passed as the buffer length to the function. The second issue is a double-free vulnerability occurring when a DataDigest mismatch happens with ErrorRecoveryLevel greater than 0. In this scenario, the handler frees the text in buffer but fails to clear the cmd->text in ptr pointer. Consequently, the same pointer is freed again during a subsequent Text Request in the iscsit setup text cmd() function or during session teardown in the iscsit release cmd() function. This can lead to a kernel BUG or slab freelist corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.