Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-63888

A critical bug in the Linux kernel’s iSCSI target code allows an attacker to read memory beyond a buffer and to free the same memory twice, which can crash the kernel or lead to privilege escalation. The flaw is triggered by iSCSI Text-phase commands that use CRC checks. The issue has been fixed in newer kernel releases.

publishedJul 19, 2026
last modifiedJul 27, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
51th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 19, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Linux kernel users on any distribution that has not yet applied the patch for CVE-2026-63888. The vulnerability affects all kernel versions that include the old iSCSI target implementation before the fix was merged.

02

Real-world impact

An attacker who can send crafted iSCSI Text commands to a target can cause the kernel to read memory it should not, potentially exposing sensitive data, and can trigger a double‑free that corrupts kernel memory. This can lead to a kernel crash or allow the attacker to execute arbitrary code with kernel privileges.

03

Why this severity

The CVSS score of 9.8 reflects that the vulnerability is exploitable remotely (AV:N), requires no user interaction (UI:N), and has no authentication or privilege requirements (PR:N). It provides complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H) for the affected system.

04

What to do about it

official fix available
recommended steps
  1. 01Update the Linux kernel to a version that includes the fix for CVE-2026-63888.
  2. 02Restart the system to ensure the new kernel is running.

NVD-referenced vendor advisory

05

Timeline

  1. Jul 19, 2026 · 14d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 20, 2026 · 13d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Jul 27, 2026 · 6d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →