The Linux kernel's iSCSI target CHAP authentication code had a flaw where the length of the base64-encoded CHAP_R response was not validated before decoding. This allowed the base64 decoder to write beyond the allocated buffer size (client_digest), causing a buffer overflow. The vulnerability arises because the allocated buffer size is based on the digest size (e.g., 32 bytes for SHA-256), but up to 95 bytes could be decoded from the input, overflowing the buffer by up to 63 bytes. The fix applies a length check before decoding by stripping trailing '=' padding characters and rejecting inputs whose decoded length would exceed the buffer size. The HEX encoding branch already had this validation. The mutual CHAP path was not vulnerable due to stricter input length limits.

This vulnerability could lead to a buffer overflow in the Linux kernel's iSCSI target CHAP authentication code. Buffer overflows in kernel code can potentially be exploited to cause denial of service or escalate privileges. However, no known exploits in the wild have been reported. The impact depends on the ability of an attacker to supply crafted CHAP_R responses to the vulnerable kernel component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, avoid exposing the vulnerable iSCSI target service to untrusted networks or inputs. Monitor vendor channels for updates and apply patches once available.