CVE-2026-23292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23292
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows: db_root: not a directory: /sys/kernel/config/target/dbroot indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking. Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582 Patch
https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b Patch
https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3 Patch
https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a Patch
https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438 Patch
https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
History

27 May 2026, 13:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: scsi: target: Corrección de bloqueo recursivo en __configfs_open_file() En flush_write_buffer, se adquiere &p->frag_sem y luego se llama a la función de almacenamiento cargada, que, aquí, es target_core_item_dbroot_store(). Esta función llamó a filp_open(), tras lo cual se llamaron a estas funciones (en orden inverso), según el rastro de llamadas: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() intenta validar la nueva ruta de archivo intentando abrir la ruta de archivo que se le proporcionó; sin embargo, en este caso, el informe de error muestra: db_root: not a directory: /sys/kernel/config/target/dbroot indicando que se intentó abrir el mismo archivo configfs, en el que está trabajando actualmente. Así, está intentando adquirir el semáforo frag_sem del mismo archivo del que ya posee el semáforo obtenido en flush_write_buffer(), lo que lleva a adquirir el semáforo de forma anidada y una posibilidad de bloqueo recursivo. Solucione esto modificando target_core_item_dbroot_store() para usar kern_path() en lugar de filp_open() para evitar abrir el archivo usando la función específica del sistema de archivos __configfs_open_file(), y modificándolo aún más para hacer que esta corrección sea compatible.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-674
References () https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582 - () https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582 - Patch
References () https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b - () https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b - Patch
References () https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3 - () https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3 - Patch
References () https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a - () https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a - Patch
References () https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438 - () https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438 - Patch
References () https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea - () https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-05-27 13:43

NVD link : CVE-2026-23292

Mitre link : CVE-2026-23292

CVE.ORG link : CVE-2026-23292

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-674

Uncontrolled Recursion