CVE-2026-23216

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

State: Published
Severity: Not scored
Published: Feb 18, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().

Scores

The record has no CVSS score.

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	e48354ce078c079996f89d715dfa44814b4eba01 to before ba684191437380a07b27666eb4e72748be1ea201Affected e48354ce078c079996f89d715dfa44814b4eba01 to before 8518f072fc92921418cd9ed4268dd4f3e9a8fd75Affected e48354ce078c079996f89d715dfa44814b4eba01 to before 275016a551ba1a068a3bd6171b18611726b67110Affected e48354ce078c079996f89d715dfa44814b4eba01 to before 73b487d44bf4f92942629d578381f89c326ff77fAffected e48354ce078c079996f89d715dfa44814b4eba01 to before 48fe983e92de2c59d143fe38362ad17ba23ec7f3Affected e48354ce078c079996f89d715dfa44814b4eba01 to before 3835e49e146a4e6e7787b29465f1a23379b6ec44Affected e48354ce078c079996f89d715dfa44814b4eba01 to before 9411a89e9e7135cc459178fa77a3f1d6191ae903Affected
LinuxLinux	3.1Affected before 3.1Not affected 5.10.250 through 5.10.Not affected 5.15.200 through 5.15.Not affected 6.1.163 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

e48354ce078c079996f89d715dfa44814b4eba01 to before ba684191437380a07b27666eb4e72748be1ea201Affected
e48354ce078c079996f89d715dfa44814b4eba01 to before 8518f072fc92921418cd9ed4268dd4f3e9a8fd75Affected
e48354ce078c079996f89d715dfa44814b4eba01 to before 275016a551ba1a068a3bd6171b18611726b67110Affected
e48354ce078c079996f89d715dfa44814b4eba01 to before 73b487d44bf4f92942629d578381f89c326ff77fAffected
e48354ce078c079996f89d715dfa44814b4eba01 to before 48fe983e92de2c59d143fe38362ad17ba23ec7f3Affected
e48354ce078c079996f89d715dfa44814b4eba01 to before 3835e49e146a4e6e7787b29465f1a23379b6ec44Affected
e48354ce078c079996f89d715dfa44814b4eba01 to before 9411a89e9e7135cc459178fa77a3f1d6191ae903Affected

LinuxLinux

3.1Affected
before 3.1Not affected
5.10.250 through 5.10.*Not affected
5.15.200 through 5.15.*Not affected
6.1.163 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.