CVE-2026-23193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23193
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca Patch
https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d Patch
https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7 Patch
https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4 Patch
https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a Patch
https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9 Patch
https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

03 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 8.8

19 Mar 2026, 17:47

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca - () https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca - Patch
References () https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d - () https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d - Patch
References () https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7 - () https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7 - Patch
References () https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4 - () https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4 - Patch
References () https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a - () https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a - Patch
References () https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9 - () https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9 - Patch
References () https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb - () https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb - Patch
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: scsi: target: iscsi: Corrección de uso después de liberación en iscsit_dec_session_usage_count() En iscsit_dec_session_usage_count(), la función llama a complete() mientras mantiene el sess->session_usage_lock. Similar a la lógica de conteo de uso de la conexión, el hilo en espera señalado por complete() (por ejemplo, en la ruta de liberación de la sesión) puede despertar y liberar la estructura iscsit_session inmediatamente. Esto crea una condición de carrera donde el hilo actual puede intentar ejecutar spin_unlock_bh() en una estructura de sesión que ya ha sido desasignada, lo que resulta en un KASAN slab-uso después de liberación. Para resolver esto, liberar el session_usage_lock antes de llamar a complete() para asegurar que todas las desreferencias del puntero sess hayan terminado antes de que se permita al hilo en espera proceder con la desasignación.

14 Feb 2026, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 17:15

Updated : 2026-04-03 14:16

NVD link : CVE-2026-23193

Mitre link : CVE-2026-23193

CVE.ORG link : CVE-2026-23193

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free