# CVE-2026-63887: Linux Kernel heap overflow in iSCSI target login negotiation

Source: https://junglewise.ai/threats/cve-2026-63887-linux-kernel-heap-overflow-in-iscsi-target-login-negotiation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-07-19  
License: CC BY 4.0 with a link back

CVE-2026-63887 · Severity: info · CVSS 8.1 · Published 2026-07-19

A vulnerability in the Linux kernel's iSCSI target implementation could allow a remote attacker to cause a system crash or potentially execute unauthorized code. The issue occurs during the login phase when the system handles specially crafted connection requests, leading to a memory overflow. This affects servers providing iSCSI storage services, potentially impacting data availability and system stability.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-63887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63887 being exploited in the wild.

**How severe is CVE-2026-63887?** Informational severity, with a CVSS score of 8.1, published 19 July 2026.

**Which products and versions are affected?** Linux Kernel v4.1 to v7.1-rc2.

**Is there a fix for CVE-2026-63887?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63887 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-63887?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in the Linux kernel's iSCSI target subsystem (iscsit). The function iscsi_encode_text_output() uses sprintf() to concatenate "key=value" records into an 8192-byte response buffer (login->rsp_buf) without verifying remaining capacity. While input PDU size is capped at 8KB, an attacker can send a PDU with many small, unknown keys. Each unknown key triggers a 16-byte "NotUnderstood" response, allowing an attacker to generate up to 32KB of output, resulting in a ~24KB overflow of the kmalloc-8k slab. This can be triggered remotely during the PHASE_SECURITY or PHASE_OPERATIONAL login stages without prior authentication. The fix replaces sprintf() with snprintf() and implements explicit bounds checking.

## Affected products

- Linux Linux Kernel v4.1 to v7.1-rc2

## Timeline

- 2026-05-11: other: Patch submitted by Michael Bommarito
- 2026-07-19: disclosed: CVE published

## References

- [https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db](https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db)
- [https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3](https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3)
- [https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b](https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b)
- [https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a](https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a)
- [https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627](https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627)
- [https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c](https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c)
- [https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39](https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)