CVE-2026-63886: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63886 Overview

CVE-2026-63886 is a heap buffer overflow in the Linux kernel iSCSI target subsystem. The vulnerability resides in chap_server_compute_hash() within the SCSI target iSCSI CHAP authentication path. The function allocates client_digest as kzalloc(chap->digest_size) and passes BASE64-encoded CHAP_R responses to chap_base64_decode() without validating whether the decoded output fits the destination buffer. An attacker reaching the iSCSI target service over the network can trigger an out-of-bounds write of up to 79 bytes past the allocation.

Critical Impact
Network-reachable heap overflow in the Linux iSCSI target enables kernel memory corruption without authentication, with potential for remote code execution in kernel context.

Affected Products

Linux kernel drivers/target/iscsi CHAP authentication component
Systems running LIO iSCSI target with CHAP authentication enabled
Multiple stable kernel branches fixed via commits 4a3a19c, 82454e6, 85db739, bf154c6, c04e857, and edd0667

Discovery Timeline

2026-07-19 - CVE-2026-63886 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63886

Vulnerability Analysis

The flaw lives in the CHAP (Challenge-Handshake Authentication Protocol) response handling in chap_server_compute_hash(). The function allocates a destination buffer sized for the negotiated digest algorithm: 16 bytes for MD5 or 32 bytes for SHA-256. For BASE64-encoded responses, the code passes the attacker-supplied chap_r string directly into chap_base64_decode() before validating the decoded length. The decoder writes to the destination unconditionally while input remains.

MAX_RESPONSE_LENGTH is 128. After extract_param() strips the 0b prefix, up to 127 base64 characters can reach the decoder. 127 base64 characters decode to 95 raw bytes. Against a 32-byte SHA-256 buffer this overflows client_digest by 63 bytes. Against a 16-byte MD5 buffer the overflow reaches 79 bytes. The existing length check at line 344 executes after the corrupting write.

Root Cause

The root cause is missing input validation on the BASE64 decoding branch. The HEX branch in the same switch statement validates the encoded length before decoding. The BASE64 branch omits this check, producing a classic out-of-bounds heap write [CWE-787]. The fix strips trailing = padding characters and rejects any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) before invoking the decoder.

Attack Vector

An unauthenticated remote attacker who can connect to an exposed iSCSI target negotiates CHAP authentication and sends a crafted CHAP_R parameter. The oversized base64 payload triggers the heap overflow during authentication processing, before credential verification completes. Corruption of adjacent slab objects can enable denial of service and, depending on heap layout, kernel-mode code execution. The mutual CHAP path decoding CHAP_C into initiatorchg_binhex is not affected because extract_param() caps input at CHAP_CHALLENGE_STR_LEN.

No public proof-of-concept exploit code is available. See the Linux Kernel Commit 85db739 for the authoritative patch.

Detection Methods for CVE-2026-63886

Indicators of Compromise

Unexpected kernel crashes, KASAN reports, or slab corruption warnings originating from chap_server_compute_hash or chap_base64_decode in kernel logs
iSCSI login PDUs containing CHAP_R=0b values longer than the expected 44 characters for SHA-256 or 24 characters for MD5
Anomalous connections to TCP port 3260 from untrusted networks followed by target daemon instability

Detection Strategies

Monitor kernel ring buffer and dmesg for BUG:, KASAN: slab-out-of-bounds, or oops entries referencing the iSCSI target module iscsi_target_mod
Inspect packet captures on port 3260 for CHAP login payloads exceeding protocol-defined digest lengths
Correlate iSCSI authentication failures with subsequent target process anomalies or reboots

Monitoring Recommendations

Enable and forward kernel logs to a central log store for retention and correlation
Alert on any iscsi_target module warnings, panics, or KASAN output following inbound iSCSI sessions
Track running kernel versions across the fleet and flag hosts on unpatched branches that expose port 3260

How to Mitigate CVE-2026-63886

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 4a3a19c, 82454e6, 85db739, bf154c6, c04e857, and edd0667, then reboot affected hosts
Restrict TCP port 3260 to trusted storage network segments using host firewalls or network ACLs
Disable the iSCSI target service on hosts that do not require LIO exports until patches are deployed

Patch Information

The fix applies BASE64 length validation before invoking chap_base64_decode(). Trailing = padding characters are stripped, and any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) is rejected. Distribution kernels should be updated to versions incorporating the referenced stable commits. See the Linux Kernel Commit 4a3a19c and Linux Kernel Commit edd0667 for backport details.

Workarounds

Block or firewall inbound access to TCP port 3260 from untrusted networks
Unload the iscsi_target_mod kernel module on systems that do not serve iSCSI LUNs
Require IPsec or private network isolation for all iSCSI initiator-to-target traffic until patched

bash

# Verify kernel version and iSCSI target module status
uname -r
lsmod | grep iscsi_target_mod

# Restrict iSCSI target port to a trusted subnet
iptables -A INPUT -p tcp --dport 3260 ! -s 10.0.0.0/24 -j DROP

# Unload the module if iSCSI target is not required
systemctl stop target.service
modprobe -r iscsi_target_mod