Heap-based buffer overflow in Linux kernel LIO iSCSI target CHAP BASE64 response handling

CVE-2026-63886 is a heap-based buffer overflow in the Linux kernel's SCSI target iSCSI authentication code during CHAP processing. In the vulnerable path, chap_server_compute_hash() allocates a digest buffer sized to chap->digest_size and, for BASE64-encoded CHAP responses, passes the attacker-controlled CHAP_R value to chap_base64_decode() without first validating whether the encoded input can decode to more bytes than the allocated digest buffer can hold. Because the decoder writes output as long as input remains, an oversized BASE64 response can overflow the heap buffer before a later length check is reached. With the documented bounds, up to 127 BASE64 characters may reach the decoder, which can decode to 95 bytes, exceeding the expected digest buffer size for algorithms such as SHA-256 or MD5. The flaw affects the iSCSI target login path prior to successful authentication. The fix adds an upfront validation step for the BASE64 branch by stripping trailing padding characters and rejecting inputs whose effective encoded length exceeds the maximum valid size for the configured digest before decoding.