CVE-2026-64103 - Vulnerability Details

- scsi: isci: Fix use-after-free in device removal path

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: isci: Fix use-after-free in device removal path

The ISCI completion tasklet is initialized in isci_host_alloc()
(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy
interrupt handlers (drivers/scsi/isci/host.c:223,613).

isci_host_deinit() stops the controller and waits for stop completion,
but it never kills completion_tasklet before teardown continues. A
top-of-function tasklet_kill() is not sufficient here: interrupts are
only disabled when isci_host_stop_complete() runs, so until
wait_for_stop() returns the IRQ handlers can still requeue the
tasklet. The tasklet callback also re-enables interrupts after draining
completions, so killing the tasklet before the source is quiesced leaves
the same race open.

Once wait_for_stop() returns, no further IRQ-driven scheduling can
occur. Kill completion_tasklet there so teardown cannot race a queued
tasklet running on a dead ihost. On remove or unload, the stale callback
can otherwise dereference ihost and touch ihost->smu_registers after the
host lifetime ends.

A UML + KASAN analogue reproduced the failure class both with no
tasklet_kill() and with tasklet_kill() placed before source quiesce, and
stayed clean once the kill happened after quiescing the scheduling
source.

This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in
device removal path"), but ISCI needs the kill after wait_for_stop().

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ISCI driver uses a completion tasklet that can be scheduled during device removal. The current implementation fails to kill the tasklet after the controller stop completes, leaving a use‑after‑free situation where the tasklet may dereference a freed controller structure. The resulting memory corruption could lead to a kernel crash or, in the worst case, a denial‑of‑service condition.

Affected Systems

All Linux kernel releases that include the ISCI driver before the patch that inserts a tasklet_kill after wait_for_stop() are vulnerable. Any system running such a kernel with the ISCI driver enabled is at risk; the advisory does not list specific vulnerable versions, so all pre‑patch ISCI implementations should be considered affected.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score of <1% suggests exploitation is unlikely under normal circumstances. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the ability to remove or unload the ISCI device. While a flaw could lead to a system crash or denial of service, there is no documented remote exploitation pathway.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< 1412995e10c74644b47f242aea6e4f3d4180e806
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< a83d3e4daba40d49324cec1c51ed261e1ea48cf1
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< ab2266601a875982f2d2033f41e070a6d5e615e2
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< 309c6058622d080fe8c2fab87c30da82d834d989
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< cb9e72c50e6c81a5903f27e0b397ce8525d7539b
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< b9ff8631006233ba246828ac70409d2cb2da38d3
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< 6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c
`6f231dda68080759f1aed3769896e94c73099f0f`	affected	< b52a8d52c3125ec9a93106ed816582368de34426

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6f231dda68080759f1aed3769896e94c73099f0f,1412995e10c74644b47f242aea6e4f3d4180e806)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,a83d3e4daba40d49324cec1c51ed261e1ea48cf1)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,ab2266601a875982f2d2033f41e070a6d5e615e2)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,309c6058622d080fe8c2fab87c30da82d834d989)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,cb9e72c50e6c81a5903f27e0b397ce8525d7539b)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,b9ff8631006233ba246828ac70409d2cb2da38d3)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,b52a8d52c3125ec9a93106ed816582368de34426)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,1412995e10c74644b47f242aea6e4f3d4180e806)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,a83d3e4daba40d49324cec1c51ed261e1ea48cf1)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,ab2266601a875982f2d2033f41e070a6d5e615e2)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,309c6058622d080fe8c2fab87c30da82d834d989)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,cb9e72c50e6c81a5903f27e0b397ce8525d7539b)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,b9ff8631006233ba246828ac70409d2cb2da38d3)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c)`	affected	code_commit	—
`[6f231dda68080759f1aed3769896e94c73099f0f,b52a8d52c3125ec9a93106ed816582368de34426)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3.0,*]`	affected	semver	—
`[0,3.0)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—
`[3.0,*]`	affected	semver	—
`[0,3.0)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[2.1.0,2.2.0)`	unaffected	semver	—
`[0,1)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch which kills the ISCI tasklet after the controller stop completes.
If an immediate kernel upgrade is not feasible, blacklist the isci module by adding "blacklist isci" to /etc/modprobe.d/blacklist.conf or by removing the module with "modprobe -r isci" before device removal.
Backport the commit that kills the ISCI tasklet after wait_for_stop() to your kernel source and rebuild the kernel.

Generated by OpenCVE AI on July 30, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806
https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989
https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c
https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1
https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2
https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426
https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3
https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b
https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64103
https://www.cve.org/CVERecord?id=CVE-2026-64103

History

Tue, 21 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64103 https://www.cve.org/CVERecord?id=CVE-2026-64103
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().
Title		scsi: isci: Fix use-after-free in device removal path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806 https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989 https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1 https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2 https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426 https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3 https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:07.372Z

Updated: 2026-07-19T15:40:07.372Z

Reserved: 2026-07-19T07:54:57.034Z

Link: CVE-2026-64103

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64103 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:45:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object