Loading vulnerability…
Use-after-free in Linux kernel iSCSI target connection teardown
CVE-2026-23216 is a use-after-free vulnerability in the Linux kernel's SCSI iSCSI target subsystem. The iscsit_dec_conn_usage_count() function calls complete() while holding conn->conn_usage_lock. This can wake a waiting thread, such as iscsit_close_connection(), which frees the iscsit_conn structure before the original thread executes spin_unlock_bh(). The subsequent attempt to release the embedded lock accesses freed memory, producing a KASAN slab-use-after-free condition. The flaw can cause kernel memory corruption and potentially denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The invalid access to a freed connection structure can cause kernel instability or a crash, disrupting the host and its storage services. Privilege escalation and broader confidentiality or integrity compromise are potential consequences of exploitable kernel memory corruption, but a demonstrated exploit achieving those outcomes is not established. CVE-specific CVSS assessments indicate high confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
Until patched, disable or unload the iSCSI target functionality where it is not required. Where it must remain enabled, restrict iSCSI connections and management access to trusted hosts through access controls and network segmentation. These measures reduce exposure but do not correct the connection-lifetime race.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the fix and reboot into the updated kernel. The code correction releases conn->conn_usage_lock before calling complete() in iscsit_dec_conn_usage_count(). Fixed packages include Debian trixie linux 6.12.73-1, RHEL 9.6 kernel 5.14.0-570.120.1.el9_6, RHEL 8.8 kernel 4.18.0-477.145.1.el8_8, and RHEL 7 ELS kernel 3.10.0-1160.148.1.el7. Use the applicable distribution and support-channel update or a later superseding release; these versions are not interchangeable across distributions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.