CVE-2026-72083

Status: UPDATED  |  Advisory ID: CVE-2026-72083

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT

parameter list with transport_kmap_data_sg() and parses the destination

TransportID with target_parse_pr_out_transport_id(). For an iSCSI

TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns

the ISID in iport_ptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transport_kunmap_data_sg() before

dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and

core_scsi3_alloc_registration(). When the parameter list spans more than

one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses

vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual

address backing iport_ptr is torn down and every subsequent dereference is

a use-after-free read of the unmapped region.

Keep the parameter list mapped until iport_ptr is no longer needed: drop

the early transport_kunmap_data_sg() and unmap once on the success path,

right before returning. The error paths already unmap through the existing

"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs

on every post-map error exit because buf is no longer cleared early. Only

reads of the mapping happen while spinlocks are held; the map and unmap

calls remain outside any lock. The sibling caller

core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it

and is left unchanged. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References