SECUFOCUSNOW
Home›CVE index›CVE-2026-63888
Review reviewCritical

CVE-2026-63888

Linux

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer lengt...

CVSS
9.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer lengt...

Affected product and versions

Product
Linux
Affected versions
>= e48354ce078c079996f89d715dfa44814b4eba01 < f7948af0dd03de84079dcd4dc215a69fd6fbb95d, >= e48354ce078c079996f89d715dfa44814b4eba01 < badf178b76b0690851df00f4ca9cf2eb8eb0f963, >= e48354ce078c079996f89d715dfa44814b4eba01 < 6e22a1cdcc8277af4acc43710577157b77a02c5d, >= e48354ce078c079996f89d715dfa44814b4eba01 < d3e9b79aa794f7a23e82de4d710e7d2df610e349, >= e48354ce078c079996f89d715dfa44814b4eba01 < ec9f19d52074a191ed1756ed4a7d39fff1a2085c, >= e48354ce078c079996f89d715dfa44814b4eba01 < 89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3, >= e48354ce078c079996f89d715dfa44814b4eba01 < 5118ea225fe63b44207ba88047e4866e1ea43812, >= e48354ce078c079996f89d715dfa44814b4eba01 < 778c2ab142c625a8a8afa570e0f9b7873f445d99, >= 3.1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-63888 — Linux | SECUFOCUS NOW