CVE-2026-63887

The CVE-2026-63887 issue affects Linux kernel SCSI/ISCSI login handling. iscsi_encode_text_output() concatenates key=value records into login->rsp_buf using an 8192-byte buffer without checking remaining capacity, while a single PDU can carry up to 2048 pairs, potentially expanding to ~32 KiB....

PT-2026-61204

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi encode text output appends to rsp buf iscsi encode text output concatenates "key=value0" records into login-rsp buf, an 8192-byte kzallocMAX KEY VALUE PAIRS buffer allocated in iscsit alloc login...