Linux kernel LIO iSCSI target: unbounded sprintf into the 8 KiB login response buffer overflows the heap

Impact

iscsi_encode_text_output() concatenates key=value records into an 8192-byte login response buffer with three unchecked sprintf() calls. The 8 KiB limit applies to the inbound Login PDU, but one PDU can carry about 2048 minimal four-byte pairs, each unknown key expanding to a 16-byte "NotUnderstood" record - roughly 32 KiB written into an 8 KiB kmalloc-8k allocation. That is a ~24 KiB controlled-length heap overrun in the kernel, triggered before login completes. Any node exporting block storage over LIO iSCSI - the usual pattern for boot LUNs and scratch volumes on a GPU fleet - is exposed to a kernel panic at minimum, with privileged code execution on the storage node the credible worst case.

Who can reach it

Anyone with TCP reach to the iSCSI target port who can send a Login PDU. The overflow happens during login key negotiation, so no valid CHAP credentials are needed.

What to do

Apply the stable-kernel fix, which adds a bounded iscsi_encode_text_record() helper using snprintf() and threads the buffer size through both the security-phase and operational-phase callers. Kernel update plus reboot on every node running the LIO target; this is the storage server side, so plan around whichever GPU nodes mount its LUNs. Meanwhile restrict the iSCSI portal to the storage VLAN and to known initiator addresses - that is the only mitigation, since the bug fires before authentication. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel LIO iSCSI target: four-byte overread and text_in_ptr double-free in the Text PDU handlerCVE-2026-63888 · Linux kernel LIO iSCSI target (iscsit_handle_text_cmd DataDigest and text_in_ptr handling)Critical
• Linux kernel sockmap: missing kTLS guard in verdict data_ready leads to use-after-freeCVE-2026-64025 · Linux kernel sockmap/skmsg (sk_psock_verdict_data_ready vs kTLS RX)Critical
• Linux kernel (net/tls): A particular kTLS ring state builds a scatterlist whose chain link points directly at anotherCVE-2026-64046 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back toCVE-2026-64047 · Linux kernel (net/tls)Critical
• Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery handler accesses the netdev pointerCVE-2026-64122 · Linux kernel mlx5_core TX timeout devlink health reporterCritical
• Linux kernel BPF devmap: cloning fragmented XDP frames for broadcast redirect reads out of boundsCVE-2026-64355 · Linux kernel BPF devmap (XDP broadcast redirect clone path)Critical