CVE-2026-23193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23193", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.985Z", "datePublished": "2026-02-14T16:27:20.251Z", "dateUpdated": "2026-10-19T18:25:34.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:35.890Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess->session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\nAC:L - The race condition is inherent in the code path \u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "versions": [{"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4", "status": "affected", "versionType": "git"}, {"version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "versions": [{"version": "3.1", "status": "affected"}, {"version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.250", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.200", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.163", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.124", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.70", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.10.250"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.15.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.12.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"}, {"url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"}, {"url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"}, {"url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"}, {"url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"}, {"url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"}, {"url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"}], "title": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-16T20:19:30.330319Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:25:34.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-16T20:19:30.330319Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T20:19:35.732Z"}}], "cna": {"title": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\nAC:L - The race condition is inherent in the code path \u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4", "versionType": "git"}, {"status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a", "versionType": "git"}], "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"status": "unaffected", "version": "0", "lessThan": "3.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.250", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.200", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.163", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.124", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.70", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.10", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"}, {"url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"}, {"url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"}, {"url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"}, {"url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"}, {"url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"}, {"url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess->session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.250", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.200", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.163", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.124", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.70", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.10", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "3.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:35.890Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23193", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:25:34.873Z", "dateReserved": "2026-01-13T15:37:45.985Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T16:27:20.251Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2b64015550a13bcc72910be0565548d9a754d46d", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}, {"lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a", "status": "affected", "version": "e48354ce078c079996f89d715dfa44814b4eba01", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/target/iscsi/iscsi_target_util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"lessThan": "3.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.250", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.200", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.163", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.124", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.70", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A068B57-89F0-436B-8831-F30BCBF37F20", "versionEndExcluding": "5.10.250", "versionStartIncluding": "3.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D16F6370-B70F-471C-8363-3A17B0BB1DA9", "versionEndExcluding": "5.15.200", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9C856E1-4308-4C0B-A973-7DD375DF66C4", "versionEndExcluding": "6.1.163", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "76183B9F-CABE-4E21-A3E3-F0EBF99DC3C7", "versionEndExcluding": "6.6.124", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3791390-0628-4808-99EF-1ED8ABF60933", "versionEndExcluding": "6.12.70", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7156C23F-009E-4D05-838C-A2DA417B5B8D", "versionEndExcluding": "6.18.10", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess->session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: target: iscsi: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en iscsit_dec_session_usage_count()\n\nEn iscsit_dec_session_usage_count(), la funci\u00f3n llama a complete() mientras mantiene el sess->session_usage_lock. Similar a la l\u00f3gica de conteo de uso de la conexi\u00f3n, el hilo en espera se\u00f1alado por complete() (por ejemplo, en la ruta de liberaci\u00f3n de la sesi\u00f3n) puede despertar y liberar la estructura iscsit_session inmediatamente.\n\nEsto crea una condici\u00f3n de carrera donde el hilo actual puede intentar ejecutar spin_unlock_bh() en una estructura de sesi\u00f3n que ya ha sido desasignada, lo que resulta en un KASAN slab-uso despu\u00e9s de liberaci\u00f3n.\n\nPara resolver esto, liberar el session_usage_lock antes de llamar a complete() para asegurar que todas las desreferencias del puntero sess hayan terminado antes de que se permita al hilo en espera proceder con la desasignaci\u00f3n."}], "id": "CVE-2026-23193", "lastModified": "2026-10-19T19:17:41.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23193", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T20:19:30.330319Z", "version": "2.0.3"}}]}, "published": "2026-02-14T17:15:57.123", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()", "id": "2439887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439887"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess->session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."], "name": "CVE-2026-23193", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23193\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23193\nhttps://lore.kernel.org/linux-cve-announce/2026021434-CVE-2026-23193-2c6c@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2b64015550a13bcc72910be0565548d9a754d46d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fd8b0900173307039d3a84644c2fee041a7ed4fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d8dbdc146e9e9a976931b78715be2e91299049f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,11ebafffce31efc6abeb28c509017976fc49f1ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,41b86a9ec037bd3435d68dd3692f0891a207e7e7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4530f4e4d0e6a207110b0ffed0c911bca43531a4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,84dc6037390b8607c5551047d3970336cb51ba9a)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.250,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.200,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.163,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.124,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.70,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.10,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-15T20:29:23.645412+00:00", "value": {"mitigation_remediation": ["Apply an updated Linux kernel that contains the fix for this use\u2011after\u2011free vulnerability.", "If an update cannot be applied immediately, consider temporarily disabling the iSCSI target or restricting iSCSI session creation until the patch is available.", "Monitor system logs for KASAN or kernel panic messages that may indicate a use\u2011after\u2011free condition and review iSCSI activity for anomalous patterns."], "summary": {"action": "Immediate Patch", "impact": "Kernel memory corruption due to use\u2011after\u2011free"}, "threat_synthesis": {"affected_systems": "All Linux Kernel builds that contain the non\u2011patched iSCSI target code are affected, including recent 6.19 release candidates from rc1 through rc6. Systems running earlier or equivalent kernel releases that have not yet incorporated the fix are also vulnerable.", "description_and_impact": "The vulnerability arises in the Linux iSCSI target code when iscsit_dec_session_usage_count() calls complete() while still holding sess->session_usage_lock. This timing allows the waiter signaled by complete() to wake up and free the iscsit_session structure before the current thread releases the lock, causing a KASAN slab\u2011use\u2011after\u2011free. The affected code can corrupt kernel memory, potentially compromising system integrity or leading to a denial of service. These issues are represented by CWE\u2011364 (Synchronization Issue) and CWE\u2011416 (Use\u2011After\u2011Free).", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely involve manipulating iSCSI sessions, for example by terminating or recreating sessions to trigger the race condition. This inference is drawn from the description of the race involving session release; the exact attack vector is not explicitly documented in the provided data."}}}}, "created": "2026-02-16T09:43:40.991301+00:00", "updated": "2026-04-15T20:30:13.783322+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}