PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-63887

CVE-2026-63887

kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

Loading…

Severity

Important

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · July 19, 2026

Updated · November 1, 2026

Description

A flaw was found in the Linux kernel's iSCSI (Internet Small Computer System Interface) target functionality. This vulnerability, a heap overrun, occurs because the iscsi_encode_text_output() function does not properly check buffer capacity when processing login requests. A remote attacker could exploit this by sending a specially crafted login request with numerous key-value pairs, leading to a memory corruption issue and potentially a denial of service (DoS) on the system.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 · Buffer Copy without Checking Size of Input