CVE-2026-72083scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4949314c7283ea4f9ade182ca599583b89f7edd6 builds before 7d56f5c868d92c9d504a34a3ea450bce481c7f63; 4949314c7283ea4f9ade182ca599583b89f7edd6 builds before 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd; 4949314c7283ea4f9ade182ca599583b89f7edd6 builds before 9f8076cc73dfa6b10155978c160587e986b22169; from 4949314c7283ea4f9ade182ca599583b89f7edd6 before a040004846f1fbe687f6ec76d9ccc27b4ead42e4; 4949314c7283ea4f9ade182ca599583b89f7edd6 builds before 05b3e37433cf2eaf8867f1c16528aa347bb212ab; from 4949314c7283ea4f9ade182ca599583b89f7edd6 before cb7bdae7fba404852ade34b0c1445fbaf3e54fbb; from 4949314c7283ea4f9ade182ca599583b89f7edd6 before ef2ee18fec92088c7d8877baf7674e89389ccd66; from 4949314c7283ea4f9ade182ca599583b89f7edd6 before fda6a1f3c3d7047b5ce5654487649c2daa738bfc; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63
- https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
- https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169
- https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4
- https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab
- https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
- https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66
- https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.