CVE-2026-23193

scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

Published Feb 14, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In iscsit_dec_session_usage_count(), the function calls complete() while
holding the sess->session_usage_lock. Similar to the connection usage count
logic, the waiter signaled by complete() (e.g., in the session release
path) may wake up and free the iscsit_session structure immediately.

This creates a race condition where the current thread may attempt to
execute spin_unlock_bh() on a session structure that has already been
deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete()
to ensure all dereferences of the sess pointer are finished before the
waiter is allowed to proceed with deallocation.

Analysis

Technical impact

The vulnerability arises in the Linux iSCSI target code when iscsit_dec_session_usage_count() calls complete() while still holding sess->session_usage_lock. This timing allows the waiter signaled by complete() to wake up and free the iscsit_session structure before the current thread releases the lock, causing a KASAN slab‑use‑after‑free. The affected code can corrupt kernel memory, potentially compromising system integrity or leading to a denial of service. These issues are represented by CWE‑364 (Synchronization Issue) and CWE‑416 (Use‑After‑Free).

Affected Systems

All Linux Kernel builds that contain the non‑patched iSCSI target code are affected, including recent 6.19 release candidates from rc1 through rc6. Systems running earlier or equivalent kernel releases that have not yet incorporated the fix are also vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely involve manipulating iSCSI sessions, for example by terminating or recreating sessions to trigger the race condition. This inference is drawn from the description of the race involving session release; the exact attack vector is not explicitly documented in the provided data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 2b64015550a13bcc72910be0565548d9a754d46d
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< fd8b0900173307039d3a84644c2fee041a7ed4fb
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< d8dbdc146e9e9a976931b78715be2e91299049f9
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 11ebafffce31efc6abeb28c509017976fc49f1ca
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 41b86a9ec037bd3435d68dd3692f0891a207e7e7
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 4530f4e4d0e6a207110b0ffed0c911bca43531a4
`e48354ce078c079996f89d715dfa44814b4eba01`	affected	< 84dc6037390b8607c5551047d3970336cb51ba9a

Linux

affected

Version	Status	Constraints
`3.1`	affected	—
`0`	unaffected	< 3.1
`5.10.250`	unaffected	≤ 5.10.*
`5.15.200`	unaffected	≤ 5.15.*
`6.1.163`	unaffected	≤ 6.1.*
`6.6.124`	unaffected	≤ 6.6.*
`6.12.70`	unaffected	≤ 6.12.*
`6.18.10`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2b64015550a13bcc72910be0565548d9a754d46d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fd8b0900173307039d3a84644c2fee041a7ed4fb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d8dbdc146e9e9a976931b78715be2e91299049f9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,11ebafffce31efc6abeb28c509017976fc49f1ca)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,41b86a9ec037bd3435d68dd3692f0891a207e7e7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4530f4e4d0e6a207110b0ffed0c911bca43531a4)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,84dc6037390b8607c5551047d3970336cb51ba9a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.250,5.11.0)`	unaffected	semver	—
`[5.15.200,5.16.0)`	unaffected	semver	—
`[6.1.163,6.2.0)`	unaffected	semver	—
`[6.6.124,6.7.0)`	unaffected	semver	—
`[6.12.70,6.13.0)`	unaffected	semver	—
`[6.18.10,*]`	unaffected	generic	—
`[6.19,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply an updated Linux kernel that contains the fix for this use‑after‑free vulnerability.
If an update cannot be applied immediately, consider temporarily disabling the iSCSI target or restricting iSCSI session creation until the patch is available.
Monitor system logs for KASAN or kernel panic messages that may indicate a use‑after‑free condition and review iSCSI activity for anomalous patterns.

Generated by OpenCVE AI on April 15, 2026 at 20:29 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4498-1	linux security update
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8278-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8289-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8296-1	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8296-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8278-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8493-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8493-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8527-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8528-1	Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN	USN-8547-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8547-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8289-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8393-1	Linux kernel (Azure FIPS) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.358% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca
https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d
https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7
https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4
https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a
https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9
https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb
https://lore.kernel.org/linux-cve-announce/2026021434-CVE-2026-23193-2c6c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23193
https://www.cve.org/CVERecord?id=CVE-2026-23193

History

Jun 16, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 3, 2026 2:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mar 19, 2026 6:00 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Feb 17, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026021434-CVE-2026-23193-2c6c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23193 https://www.cve.org/CVERecord?id=CVE-2026-23193
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Feb 14, 2026 4:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
Title		scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7 https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4 https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9 https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb