CVE-2026-63886 | CVSS 9.8 Critical Pre-auth heap buffer overflow in the Linux kernel iSCSI target — any attacker on the network can corrupt kernel memory before authentication starts, using only a crafted CHAP username. Root cause: chap_server_compute_hash() in iscsi_target_auth.c passes attacker-controlled input directly to chap_base64_decode() with no length check. The destination buffer is allocated with kzalloc(digest_size) — 16 bytes for MD5, 32 bytes for SHA-256. A 127-char username decodes to 95 bytes. Overflow: 79 bytes past end of allocation in kmalloc-16. No active iSCSI session required. The CHAP username is sent during the login phase, before any credential validation. Any host with network access to the iSCSI port can trigger the overflow. Confirmed with KASAN on linux-next. Vulnerable code introduced in 2022 (commit 1e5733883421), present in all kernels 5.19–7.0. Fix: commit 85db7391310b — bounds check before decode, backported to 6.1, 6.6, 6.12 stable. Full write-up (root cause, KASAN trace, patch): http://ahossu.github.io/blog/iscsi-chap-base64-overflow #Linux #kernel #CVE #infosec
Post summary
The post discloses a critical pre‑authentication heap buffer overflow in Linux iSCSI targets, detailing the technical root cause, affected versions, and a patch commit.
