CVE-2026-63888: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63888 Overview

CVE-2026-63888 is a critical Linux kernel vulnerability in the iSCSI target subsystem (LIO). The flaw resides in iscsit_handle_text_cmd() and combines two latent bugs: a DataDigest CRC buffer overread and a stale pointer double-free condition. Both bugs have existed since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"). The vulnerability is reachable over the network without authentication when an iSCSI target is exposed and DataDigest=CRC32C is negotiated. On distribution kernels built with CONFIG_SLAB_FREELIST_HARDENED=y, exploitation of the double-free triggers a remote kernel BUG(). On non-hardened kernels, the double-free corrupts the slab freelist.

Critical Impact
Unauthenticated network attackers can trigger a slab out-of-bounds read and a double-free in the Linux kernel iSCSI target, leading to remote kernel panic or slab corruption suitable for further exploitation.

Affected Products

Linux kernel iSCSI target (LIO) subsystem — drivers/target/iscsi/
All kernel versions since commit e48354ce078c introducing iSCSI fabric support for target v4.1
Systems exporting iSCSI LUNs with DataDigest=CRC32C negotiation enabled

Discovery Timeline

2026-07-19 - CVE-2026-63888 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63888

Vulnerability Analysis

The vulnerability affects the iSCSI Text-phase handler iscsit_handle_text_cmd() in the Linux kernel target subsystem. Two independent flaws exist in the same function. The first is an out-of-bounds read during CRC computation. The second is a double-free of cmd->text_in_ptr when ErrorRecoveryLevel > 0 and a DataDigest mismatch occurs.

The handler allocates text_in using kzalloc() sized to ALIGN(payload_length, 4). It then increments rx_size by ISCSI_CRC_LEN (4 bytes) to reserve iovec space for the received DataDigest. The same inflated rx_size value is subsequently passed as the buffer length argument to iscsit_crc_buf(), which walks the buffer with crc32c(). The CRC routine reads 4 bytes past the end of the text_in allocation on every Text PDU that negotiates DataDigest=CRC32C.

Root Cause

The root cause is a length-tracking error: rx_size serves double duty as both the iovec receive length and the CRC compute length, but only the former should include ISCSI_CRC_LEN. The second bug stems from failing to clear cmd->text_in_ptr after kfree(text_in) in the ERL>0 silent-drop path. When the initiator sends a follow-up Text Request on the same ITT, iscsit_setup_text_cmd() unconditionally frees the stale pointer. If the connection is torn down first, iscsit_release_cmd() performs the second free instead.

Attack Vector

A remote unauthenticated attacker with network reach to an iSCSI target logs into a session and negotiates DataDigest=CRC32C. Every Text PDU issued from that session triggers the KASAN-reportable slab out-of-bounds read. To reach the double-free, the attacker sends a Text Request with a deliberately incorrect DataDigest on a target where ErrorRecoveryLevel > 0, then either issues a second Text Request reusing the same Initiator Task Tag or drops the connection to trigger session teardown. The double-free on hardened kernels produces a remote BUG(); on non-hardened kernels it enables slab freelist corruption.

// Vulnerable pattern in iscsit_handle_text_cmd() - described in prose
// text_in = kzalloc(ALIGN(payload_length, 4), GFP_KERNEL);
// rx_size += ISCSI_CRC_LEN;   // extends iovec for received digest
// ...
// data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);  // OOB read: 4 bytes past text_in
//
// ERL>0 mismatch path:
// kfree(text_in);
// return 0;                    // cmd->text_in_ptr still references freed memory

Detection Methods for CVE-2026-63888

Indicators of Compromise

Kernel log entries containing BUG: KASAN: slab-out-of-bounds in crc32c originating from the Text PDU code path
Kernel log entries containing BUG: KASAN: double-free in iscsit_setup_text_cmd or BUG: KASAN: double-free in iscsit_release_cmd
Unexpected kernel BUG() panics on iSCSI target hosts running kernels with CONFIG_SLAB_FREELIST_HARDENED=y
Anomalous or malformed Text Request PDUs with intentionally invalid DataDigest values arriving at TCP/3260

Detection Strategies

Monitor kernel ring buffer and journald on iSCSI target hosts for KASAN reports or slab freelist corruption warnings
Deploy network telemetry on TCP/3260 to identify repeated Text PDU sequences from the same initiator with rapid session teardown
Correlate iSCSI target crashes with recent authentication or discovery activity from unfamiliar source addresses

Monitoring Recommendations

Alert on any process crash or kernel oops on hosts running the LIO target daemon
Track initiator IQNs establishing sessions that negotiate DataDigest=CRC32C and ErrorRecoveryLevel > 0
Ingest kernel telemetry and iSCSI access logs into a centralized SIEM for cross-host correlation

How to Mitigate CVE-2026-63888

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits 5118ea2, 6e22a1c, 778c2ab, 89c81d1, badf178, d3e9b79, ec9f19d, and f7948af
Restrict network access to TCP/3260 using host firewalls or network ACLs so only trusted initiator subnets can reach the target
Disable DataDigest=CRC32C negotiation on exposed targets where operationally acceptable until patches are deployed
Audit exposed iSCSI targets and remove any that are not required for production storage workflows

Patch Information

The upstream fix consists of two one-line changes to iscsit_handle_text_cmd(). The first passes ALIGN(payload_length, 4) as the CRC length instead of the inflated rx_size. The second clears cmd->text_in_ptr = NULL after kfree(text_in) in the ERL>0 drop path. The Text PDU state machine and iSCSI wire protocol are unchanged. Refer to the following stable-tree commits: Kernel Commit 5118ea2, Kernel Commit 6e22a1c, Kernel Commit 778c2ab, Kernel Commit 89c81d1, Kernel Commit badf178, Kernel Commit d3e9b79, Kernel Commit ec9f19d, and Kernel Commit f7948af.

Workarounds

Block or filter inbound TCP/3260 at the network edge for any initiator not explicitly authorized
Configure the LIO target to reject sessions negotiating DataDigest=CRC32C where the risk outweighs integrity benefits
Set ErrorRecoveryLevel=0 on target portal groups to eliminate the silent-drop path that leads to the double-free
Enforce iSCSI CHAP mutual authentication to limit which initiators can reach the Text PDU code path

bash

# Example targetcli configuration to disable DataDigest and enforce CHAP
targetcli /iscsi/<target-iqn>/tpg1 set attribute demo_mode_write_protect=1
targetcli /iscsi/<target-iqn>/tpg1 set attribute authentication=1
targetcli /iscsi/<target-iqn>/tpg1 set parameter DataDigest=None
targetcli /iscsi/<target-iqn>/tpg1 set parameter ErrorRecoveryLevel=0

# Restrict inbound iSCSI access at the host firewall
iptables -A INPUT -p tcp --dport 3260 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3260 -j DROP