CVE-2026-23216
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().
How to fix
- linux linux_kernel5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.1 ≤ v < 5.10.250, 5.11 ≤ v < 5.15.200, 5.16 ≤ v < 6.1.163, 6.2 ≤ v < 6.6.124, 6.7 ≤ v < 6.12.70, 6.13 ≤ v < 6.18.10, 6.19 | 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.