CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount()
In iscsitdecsessionusagecount(), the function calls complete() while holding the sess->sessionusagelock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsitsession structure immediately.
This creates a race condition where the current thread may attempt to execute spinunlockbh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free.
To resolve this, release the sessionusagelock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount()
In iscsitdecsessionusagecount(), the function calls complete() while holding the sess-sessionusagelock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsitsession structure immediately.
This creates a race condition where the current thread may attempt to execute spinunlockbh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free.
To resolve this, release the sessionusagelock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In iscsit_dec_session_usage_count(), release sess->session_usage_lock before calling complete(), ensuring all dereferences of the sess pointer are finished before complete() can wake the waiter and trigger deallocation of the iscsit_session structure.
Linux kernel (scsi: target: iscsi) Release session_usage_lock before calling complete() in iscsit_dec_session_usage_count() = Release sess->session_usage_lock immediately before complete() and ensure dereferences of sess are finished before the waiter proceeds with deallocation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23193?
CVE-2026-23193 is classified as a medium severity vulnerability due to its potential for causing a use-after-free condition.
How do I fix CVE-2026-23193?
To fix CVE-2026-23193, update your Linux kernel to the latest stable version that addresses this vulnerability.
What types of systems are affected by CVE-2026-23193?
CVE-2026-23193 affects systems running the Linux kernel with implementations of the iscsi target.
What impact does CVE-2026-23193 have on system security?
CVE-2026-23193 may lead to potential denial-of-service conditions or can be exploited for privilege escalation.
When was CVE-2026-23193 disclosed?
CVE-2026-23193 was disclosed in 2026 and has since been addressed by updates to the Linux kernel.