CVE-2026-63887

What it actually does

This is a remotely reachable heap buffer overflow in the Linux kernel iSCSI target login path. During iSCSI login negotiation, the kernel builds text response records in a fixed 8192-byte response buffer. The vulnerable code appends key=value records with unbounded sprintf-style writes and does not verify remaining capacity. A crafted login request containing many small, unrecognized text keys can cause the target to generate many larger NotUnderstood responses, expanding the output beyond the allocated buffer and corrupting adjacent kmalloc-8k heap memory. Because the vulnerable path is network-accessible, requires no authentication, and runs in kernel context, successful exploitation could plausibly lead to kernel crash, memory corruption, denial of service, or potentially arbitrary code execution with kernel privileges.

Why it matters to the business

Systems exposing the Linux kernel iSCSI target service may be vulnerable to unauthenticated remote compromise or service disruption. Operational impact can include storage target outages, interrupted access to block storage, host crashes, data unavailability, and potential full system takeover if exploitation achieves kernel-level code execution. Although this issue is not currently listed in CISA KEV and the provided EPSS score is low, the CVSS severity is critical and the attack surface is network-accessible, so internet-exposed or broadly reachable iSCSI targets should be prioritized for remediation.

How an attack unfolds

An attacker identifies a host exposing the Linux kernel iSCSI target service, typically over TCP port 3260. The attacker initiates an iSCSI login negotiation and sends a crafted Login PDU containing a large number of minimal or unknown text key-value records. The vulnerable target attempts to produce response text records for the unrecognized keys, expanding them into NotUnderstood responses. Because the vulnerable kernel code appends these responses into a fixed-size login response buffer without checking remaining space, the response buffer can overflow into adjacent kernel heap memory. Depending on heap layout and exploit reliability, this may cause an immediate kernel crash, target service failure, memory corruption, or a path toward kernel-level code execution.

How to fix it

Apply a kernel update that includes the fix for the iSCSI target text response encoding bounds check. The corrected implementation uses bounded formatting, tracks remaining response-buffer capacity, drops excess queued responses, and returns an explicit login failure instead of overflowing the buffer. No specific fixed package versions were provided in the input, so use the latest security-supported kernel from the operating system or distribution vendor and verify that the vendor advisory for this issue is included. If immediate patching is not possible, reduce exposure by disabling the Linux kernel iSCSI target service where not required, restricting TCP/3260 to trusted initiator networks only, blocking untrusted access at firewalls, and monitoring for abnormal login negotiation activity. Avoid relying on authentication alone, because the vulnerable code path is reachable before successful login completion.

How to confirm the fix worked

Confirm exposure by determining whether the system runs the Linux kernel iSCSI target implementation and accepts iSCSI login connections, especially on TCP/3260. Validate remediation by checking the installed kernel package against the relevant distribution advisory or by confirming the kernel source includes the bounded iscsi_encode_text_record() helper and the updated iscsi_encode_text_output() call sites with a text buffer size parameter. Operationally, verify that iSCSI target access is limited to expected initiator networks and that unauthenticated or untrusted sources cannot reach the service. After patching, controlled negative testing should show that oversized or excessive login text negotiation is rejected with an initiator error rather than causing kernel warnings, crashes, slab corruption, or service instability.

Typical attack path

1. Scan for systems exposing the iSCSI target service, commonly TCP/3260.
2. Open an iSCSI login session to the target without needing valid credentials.
3. Send a crafted login negotiation request containing many small or unknown text key-value records.
4. Trigger the target to generate oversized NotUnderstood response records into the fixed 8192-byte login response buffer.
5. Cause heap memory corruption in the kernel iSCSI target code path.
6. Leverage the corruption to crash the host, disrupt storage access, or attempt further exploitation for kernel-level control.

How to detect it

Investigate whether the vulnerability was already exploited by correlating network, host, and kernel telemetry around iSCSI target login activity. Useful sources include firewall logs for TCP/3260 access, IDS/packet captures for iSCSI Login Requests, kernel logs from dmesg or journald, system crash dumps, service supervision logs, and storage-path monitoring. Look for unauthenticated or unexpected initiator IPs making repeated login attempts, unusually large Login PDUs near the protocol input ceiling, a high number of NUL-delimited text key records, many unrecognized login keys that cause NotUnderstood responses, and login failures immediately preceding kernel instability. Host artifacts may include kernel oops or panic messages, slab allocator corruption, use-after-free or general protection fault reports, stack traces involving the iSCSI target login functions, unexpected reboots, or abrupt loss of iSCSI target availability. Because public exploitation is not indicated in the provided data, absence of known malware or named actor indicators should not be treated as proof of non-exploitation; focus on protocol abuse and kernel-fault symptoms.

• tcp/3260 inbound connection from unexpected source
• NotUnderstood
• iscsi_encode_text_output
• iscsi_encode_text_record
• iscsi_add_notunderstood_response
• iscsi_target_handle_csg_zero
• iscsi_target_handle_csg_one
• iscsit_tx_login_rsp
• iscsit_alloc_login_setup_buffer
• ISCSI_STATUS_CLS_INITIATOR_ERR
• ISCSI_LOGIN_STATUS_INIT_ERR
• slab corruption
• kernel BUG
• general protection fault
• Oops:
• Kernel panic
• kmalloc-8k
• iSCSI Login Request
• Login PDU

What your security team should do

• Inventory Linux systems that expose iSCSI target services, prioritizing hosts reachable from untrusted networks or shared infrastructure segments.
• Patch affected Linux kernels using vendor-provided security updates as soon as practical; treat exposed storage targets as high priority because the flaw is unauthenticated and kernel-level.
• Restrict TCP/3260 and any other configured iSCSI target listener ports to known initiator IP ranges using network firewalls and host-based controls.
• Disable the iSCSI target service on systems that do not explicitly require it.
• Review kernel logs, system journals, and network telemetry for abnormal iSCSI login negotiation activity, especially repeated failed logins or requests containing many unknown text keys.
• Add IDS/SIEM detections for unusually large iSCSI Login PDUs, high counts of NUL-delimited text keys in a single login request, and repeated NotUnderstood negotiation behavior.
• Monitor for post-trigger symptoms such as kernel oops, slab corruption reports, unexpected reboots, target service instability, or storage path outages.
• Because this is not currently KEV-listed and exploit maturity is reported as none, balance emergency response against exposure: patch internet-facing or widely reachable targets first, then internal restricted targets.