CyberSecBulletin
CVE-2026-63887NVD status: Analyzed

Linux: Buffer Copy without Checking Size of Input

Published Updated By the CyberSecBulletin desk

CVE-2026-63887 is a critical-severity buffer copy without checking size of input vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions cb84e974fb172bc71386289f37b78ea679410b39, b19382dfc6e7dee6d3859ba44b6ca29e97a51627, efe633e600a0ac68357206fede21b1ac8178f3b8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.78% chance of exploitation within 30 days, higher than 56% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to cb84e974fb172bc71386289f37b78ea679410b39 or b19382dfc6e7dee6d3859ba44b6ca29e97a51627 or efe633e600a0ac68357206fede21b1ac8178f3b8 or 4e9f0c4a645c995bc75c06c7b3644254ffb4c76b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxe48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, cb84e974fb172bc71386289f37b78ea679410b39; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, b19382dfc6e7dee6d3859ba44b6ca29e97a51627; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, efe633e600a0ac68357206fede21b1ac8178f3b8; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, 4e9f0c4a645c995bc75c06c7b3644254ffb4c76b; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, 30bf335e8fe170322080ee001f05ca29c50680b3; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, 594a40360012ce5f94c715d5e3b20fa3af7d525a; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, 26e4a304b7e6f1338c675d527608d32549c091db; e48354ce078c079996f89d715dfa44814b4eba01 up to, but not including, bf33e01f88388c43e285492a63e539df6ffed64c; and 1 more rangescb84e974fb172bc71386289f37b78ea679410b39, b19382dfc6e7dee6d3859ba44b6ca29e97a51627, efe633e600a0ac68357206fede21b1ac8178f3b8, 4e9f0c4a645c995bc75c06c7b3644254ffb4c76b, 30bf335e8fe170322080ee001f05ca29c50680b3, 594a40360012ce5f94c715d5e3b20fa3af7d525a
LinuxLinux Kernel3.1 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Buffer Copy without Checking Size of Input

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.

More Buffer Copy without Checking Size of Input vulnerabilities (CWE-120)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Buffer Copy without Checking Size of Input vulnerabilities

Spotted an error? Tell us.