CVE-2026-23216

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23216
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110 Patch
https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44 Patch
https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3 Patch
https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f Patch
https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75 Patch
https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903 Patch
https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

18 Mar 2026, 20:28

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110 - () https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110 - Patch
References () https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44 - () https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44 - Patch
References () https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3 - () https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3 - Patch
References () https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f - () https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f - Patch
References () https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75 - () https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75 - Patch
References () https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903 - () https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903 - Patch
References () https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201 - () https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: scsi: target: iscsi: Corrección de uso después de liberación en iscsit_dec_conn_usage_count() En iscsit_dec_conn_usage_count(), la función llama a complete() mientras mantiene el conn->conn_usage_lock. Tan pronto como se invoca complete(), el proceso en espera (como iscsit_close_connection()) puede despertarse y proceder a liberar la estructura iscsit_conn. Si el proceso en espera libera la memoria antes de que el hilo actual alcance spin_unlock_bh(), resulta en un KASAN slab-uso después de liberación, ya que la función intenta liberar un bloqueo dentro de la estructura de conexión ya liberada. Esto se corrige liberando el spinlock antes de llamar a complete().
First Time Linux
Linux linux Kernel
CWE CWE-416

18 Feb 2026, 15:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 15:18

Updated : 2026-03-18 20:28

NVD link : CVE-2026-23216

Mitre link : CVE-2026-23216

CVE.ORG link : CVE-2026-23216

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free