Linux kernel LIO iSCSI target: four-byte overread and text_in_ptr double-free in the Text PDU handler

Impact

Two defects in the Text-phase handler, present since the original LIO merge. First, the DataDigest CRC is computed over rx_size, which has already been bumped by the 4-byte digest length, so crc32c() reads four bytes past the text_in allocation on every Text PDU with DataDigest=CRC32C - KASAN flags it as slab-out-of-bounds. Second, on a DataDigest mismatch with ErrorRecoveryLevel > 0 the handler frees text_in but leaves cmd->text_in_ptr pointing at it; the next Text Request on the same ITT, or session teardown via iscsit_release_cmd(), frees the same pointer again. The double-free is the serious half: a slab free of an attacker-influenced pointer on a storage node serving GPU hosts, reachable after login. This is distinct from the login-buffer overflow in the same subsystem and has its own commits.

Who can reach it

An iSCSI initiator that has completed login to the target and can send Text Requests with DataDigest negotiated. The overread needs only DataDigest=CRC32C; the double-free needs a deliberate digest mismatch on a target configured with ErrorRecoveryLevel > 0. Authentication to the target is required.

What to do

Apply the stable-kernel fix: the CRC length becomes ALIGN(payload_length, 4) and cmd->text_in_ptr is cleared on the ERL>0 drop path. Kernel update plus reboot of each node running the LIO iSCSI target. Setting ErrorRecoveryLevel back to 0 removes the double-free path but not the overread. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel sockmap: missing kTLS guard in verdict data_ready leads to use-after-freeCVE-2026-64025 · Linux kernel sockmap/skmsg (sk_psock_verdict_data_ready vs kTLS RX)Critical
• Linux kernel (net/tls): A particular kTLS ring state builds a scatterlist whose chain link points directly at anotherCVE-2026-64046 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the kTLS transmit scatterlist ring wraps, the chain link that stitches the tail back toCVE-2026-64047 · Linux kernel (net/tls)Critical
• Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery handler accesses the netdev pointerCVE-2026-64122 · Linux kernel mlx5_core TX timeout devlink health reporterCritical
• Linux kernel BPF devmap: cloning fragmented XDP frames for broadcast redirect reads out of boundsCVE-2026-64355 · Linux kernel BPF devmap (XDP broadcast redirect clone path)Critical
• Linux kernel krb5 crypto: use-after-free when an async AEAD backend is bound to the enctypeCVE-2026-64439 · Linux kernel krb5 crypto helpers (rfc3961_simplified / rfc8009_aes2 AEAD paths)Critical