CVE-2026-23193 (GCVE-0-2026-23193)
Vulnerability from cvelistv5
Published
2026-02-14 16:27
Modified
2026-08-05 12:20
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
References
Impacted products
Vendor Product Version
Linux Linux Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
Version: e48354ce078c079996f89d715dfa44814b4eba01
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:19:30.330319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:19:39.064Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.250",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.250",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\nAC:L - The race condition is inherent in the code path \u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:35.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"
        }
      ],
      "title": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23193",
    "datePublished": "2026-02-14T16:27:20.251Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-08-05T12:20:35.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23193\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T20:19:30.330319Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T20:19:35.732Z\"}}], \"cna\": {\"title\": \"scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\\nAC:L - The race condition is inherent in the code path \\u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"2b64015550a13bcc72910be0565548d9a754d46d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"fd8b0900173307039d3a84644c2fee041a7ed4fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"d8dbdc146e9e9a976931b78715be2e91299049f9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"11ebafffce31efc6abeb28c509017976fc49f1ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"41b86a9ec037bd3435d68dd3692f0891a207e7e7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"4530f4e4d0e6a207110b0ffed0c911bca43531a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e48354ce078c079996f89d715dfa44814b4eba01\", \"lessThan\": \"84dc6037390b8607c5551047d3970336cb51ba9a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/target/iscsi/iscsi_target_util.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.250\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.200\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/target/iscsi/iscsi_target_util.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d\"}, {\"url\": \"https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb\"}, {\"url\": \"https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9\"}, {\"url\": \"https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca\"}, {\"url\": \"https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7\"}, {\"url\": \"https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4\"}, {\"url\": \"https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\\n\\nIn iscsit_dec_session_usage_count(), the function calls complete() while\\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\\nlogic, the waiter signaled by complete() (e.g., in the session release\\npath) may wake up and free the iscsit_session structure immediately.\\n\\nThis creates a race condition where the current thread may attempt to\\nexecute spin_unlock_bh() on a session structure that has already been\\ndeallocated, resulting in a KASAN slab-use-after-free.\\n\\nTo resolve this, release the session_usage_lock before calling complete()\\nto ensure all dereferences of the sess pointer are finished before the\\nwaiter is allowed to proceed with deallocation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.250\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.200\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.163\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.124\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.70\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.10\", \"versionStartIncluding\": \"3.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:20:35.890Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23193\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:20:35.890Z\", \"dateReserved\": \"2026-01-13T15:37:45.985Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-14T16:27:20.251Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.