CVE-2026-63886
Received Received - Intake

Buffer Overflow in Linux Kernel iSCSI Target

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and the "0b" prefix stripped by extract_param(), up to 127 base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32) this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length check at line 344 fires after the write has already happened. The HEX branch in the same switch statement already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64 padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size, DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is added at the call site to document this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63886
EUVD
EUVD-2026-45771

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's SCSI target iSCSI subsystem. It occurs when processing CHAP authentication responses. The issue arises because the code does not validate the length of BASE64-encoded CHAP_R data before decoding it, allowing an attacker to provide input that overflows a fixed-size buffer. Specifically, a long BASE64 string can decode to more bytes than allocated for the digest, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI target iSCSI subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or examining the kernel version against patched versions. Commands like 'dmesg | grep -i iscsi' or 'uname -a' may help identify affected systems.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. This could lead to unauthorized access, data breaches, or system compromise if the vulnerable system is part of a networked environment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized memory writes through buffer overflow in the iSCSI CHAP authentication process. Unauthorized memory access may lead to data leaks or integrity issues, which are critical concerns under these regulations.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution. If immediate patching is not possible, disable the iSCSI target service temporarily until updates are applied. Monitor vendor advisories for specific mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart