The Linux kernel's iSCSI target (iscsit) had two latent bugs in the Text-phase handler since its original integration. First, a DataDigest CRC buffer overread occurred because the CRC calculation read 4 bytes past the allocated buffer due to incorrect length passed to the CRC function. Second, a double-free vulnerability arose when a DataDigest mismatch with ErrorRecoveryLevel > 0 caused the buffer to be freed but the pointer was not cleared, leading to a second free on subsequent requests or session teardown. Both issues were fixed by correcting the length parameter for the CRC calculation and clearing the pointer after freeing the buffer. These fixes do not change the protocol or state machine behavior.

The buffer overread causes the kernel to read beyond allocated memory, which may lead to kernel memory corruption or crashes. The double-free can corrupt kernel memory management structures, potentially causing kernel crashes or denial of service. There is no indication that these issues allow direct attacker-controlled data to flow back or enable privilege escalation. The bugs affect kernel stability and reliability when processing iSCSI Text PDUs with DataDigest enabled and ErrorRecoveryLevel > 0.

A fix is available and has been applied to the Linux kernel source code. Users should update their Linux kernel to a version that includes these patches. Since this is a kernel vulnerability, applying the official kernel update from the distribution or mainline kernel is the recommended remediation. No alternative mitigations or workarounds are indicated.