CVE-2026-63887: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63887 Overview

CVE-2026-63887 is a critical heap buffer overflow in the Linux kernel's iSCSI target subsystem. The flaw resides in iscsi_encode_text_output() within drivers/target/iscsi, where unbounded sprintf() calls append key=value records into an 8192-byte response buffer allocated by iscsit_alloc_login_setup_buffer(). A remote initiator can send a Login PDU containing up to 2048 minimal four-byte a=b\0 pairs, each expanding to a 16-byte a=NotUnderstood\0 response record. The resulting 32 KiB of output into the 8 KiB kmalloc-8k slab produces a ~24 KiB heap overrun, reachable pre-authentication over the network.

Critical Impact
Unauthenticated remote attackers can trigger a ~24 KiB heap overrun in the kernel's kmalloc-8k slab by sending a crafted iSCSI Login PDU, enabling denial of service and potentially kernel memory corruption leading to code execution.

Affected Products

Linux kernel iSCSI target subsystem (drivers/target/iscsi)
Kernel versions up to and including v7.1-rc2 prior to the referenced stable commits
Distributions shipping LIO/iSCSI target with unpatched kernels

Discovery Timeline

2026-07-19 - CVE-2026-63887 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63887

Vulnerability Analysis

The vulnerability is a classic heap buffer overflow [CWE-122] in the iSCSI login negotiation path. iscsi_encode_text_output() concatenates key=value\0 records into login->rsp_buf, an 8192-byte buffer allocated with kzalloc(MAX_KEY_VALUE_PAIRS) in iscsit_alloc_login_setup_buffer(). Three sprintf() call sites at lines 1398, 1411, and 1424 in v7.1-rc2 write output without validating remaining buffer capacity.

The 8192-byte ceiling enforced by iscsi_target_check_login_request() bounds only the incoming Login PDU payload, not the encoded response. A single input PDU can therefore carry a large number of short records whose encoded responses expand well beyond the response buffer's capacity.

Because the write occurs in the kmalloc-8k slab, the overrun corrupts adjacent kernel slab objects. This creates conditions for denial of service through kernel panic and, depending on adjacent allocations, potential exploitation for arbitrary kernel code execution.

Root Cause

The root cause is missing length validation in a length-tracking output loop. Each iteration executes *length += sprintf(output_buf, "%s=%s", er->key, er->value) followed by *length += 1 and output_buf = textbuf + *length, but no check compares *length against the fixed 8192-byte MAX_KEY_VALUE_PAIRS ceiling before writing.

Attack Vector

An unauthenticated remote attacker connects to an exposed iSCSI target port (typically TCP 3260) and initiates login negotiation. The attacker crafts a Login PDU packed with the maximum number of short unknown key=value pairs. Each unknown key triggers iscsi_add_notunderstood_response(), which queues a 16-byte key=NotUnderstood\0 record. When iscsi_encode_text_output() serializes 2048 such records, it writes approximately 32 KiB into the 8 KiB buffer, producing a ~24 KiB out-of-bounds write in kernel slab memory.

The upstream fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with per-call bounds checks against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1. Both callers now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning.

Detection Methods for CVE-2026-63887

Indicators of Compromise

Unexpected kernel panics or Oops messages referencing iscsi_encode_text_output, iscsit_alloc_login_setup_buffer, or slab corruption in kmalloc-8k.
Anomalous inbound TCP connections to iSCSI target port 3260 from untrusted networks, followed by immediate kernel instability.
Login PDUs containing an unusually high count of unknown or malformed key=value pairs in packet captures.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) or SLUB debugging on test kernels to catch out-of-bounds writes in the iSCSI target path.
Monitor kernel ring buffer (dmesg) for iSCSI Login negotiation failed errors correlated with source IPs sending abnormally large Login PDUs.
Deploy network intrusion detection signatures that flag iSCSI Login PDUs containing hundreds of NotUnderstood key candidates within a single request.

Monitoring Recommendations

Log all iSCSI initiator connection attempts and correlate against expected initiator IQNs and source subnets.
Alert on repeated failed login negotiations from a single source, which may indicate exploit attempts probing buffer boundaries.
Track host stability metrics on storage servers running LIO target and investigate any unexplained kernel reboots.

How to Mitigate CVE-2026-63887

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the Kernel Git Commits as soon as vendor-supplied builds are available.
Restrict iSCSI target port 3260 to trusted storage-network segments using host firewalls or network ACLs.
Audit exposed iSCSI targets and disable the LIO iSCSI target service (targetcli / target.service) on hosts that do not require it.

Patch Information

The fix is available across multiple stable branches. Relevant commits include 26e4a304b7e6, 30bf335e8fe1, 4e9f0c4a645c, 594a40360012, b19382dfc6e7, bf33e01f8838, cb84e974fb17, and efe633e600a0. The patch replaces unchecked sprintf() with bounded snprintf() calls and adds explicit overflow handling that returns a login error to the initiator.

Workarounds

Unload the iscsi_target_mod kernel module on hosts that do not serve iSCSI LUNs to eliminate the attack surface entirely.
Enforce IPsec or dedicated storage VLAN isolation so only authenticated storage clients can reach TCP port 3260.
Configure targetcli ACLs to restrict initiator IQNs, reducing exposure even when the service is reachable.