7.8

CVE-2026-23216

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked, the
waiter (such as iscsit_close_connection()) may wake up and proceed to free
the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function
attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.1 < 5.10.250
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.200
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.163
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.124
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.70
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.10
Linux ≫ Linux Kernel Version 6.19 Update rc1
Linux ≫ Linux Kernel Version 6.19 Update rc2
Linux ≫ Linux Kernel Version 6.19 Update rc3
Linux ≫ Linux Kernel Version 6.19 Update rc4
Linux ≫ Linux Kernel Version 6.19 Update rc5
Linux ≫ Linux Kernel Version 6.19 Update rc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.019
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201
Patch
https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75
Patch
https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110
Patch
https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f
Patch
https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3
Patch
https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44
Patch
https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903
Patch