Linux kernel scsi:target:iscsi CHAP auth mishandles BASE64 CHAP_R, decoding into client_digest (kzalloc(chap->digest_size)) without pre-checking input/output size, causing a heap overflow (e.g., 127 chars → 95 bytes vs SHA-256 32). Remote network trigger can corrupt memory and crash/compromise the kernel. Patch via upstream stable fixes validating length before chap_base64_decode().