Bug 2440630 (CVE-2026-23216)

Summary: CVE-2026-23216 kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A use-after-free flaw was found in the Linux kernel's iSCSI target subsystem. In the iscsit_dec_conn_usage_count() function, complete() is called while still holding the conn->conn_usage_lock spinlock. The waiting thread (such as iscsit_close_connection()) may wake up immediately and free the iscsit_conn structure before the current thread executes spin_unlock_bh(), resulting in a use-after-free when attempting to release the lock on already-freed memory.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-18 15:02:39 UTC
In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

In iscsit_dec_conn_usage_count(), the function calls complete() while
holding the conn->conn_usage_lock. As soon as complete() is invoked, the
waiter (such as iscsit_close_connection()) may wake up and proceed to free
the iscsit_conn structure.

If the waiter frees the memory before the current thread reaches
spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function
attempts to release a lock within the already-freed connection structure.

Fix this by releasing the spinlock before calling complete().

Comment 6 errata-xmlrpc 2026-04-22 20:40:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:9870 https://access.redhat.com/errata/RHSA-2026:9870

Comment 7 errata-xmlrpc 2026-04-27 10:31:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:10756 https://access.redhat.com/errata/RHSA-2026:10756

Comment 8 errata-xmlrpc 2026-06-04 10:22:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:23237 https://access.redhat.com/errata/RHSA-2026:23237

Comment 9 errata-xmlrpc 2026-06-04 15:45:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:22964 https://access.redhat.com/errata/RHSA-2026:22964

Comment 10 errata-xmlrpc 2026-06-11 10:13:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:25217 https://access.redhat.com/errata/RHSA-2026:25217

Comment 11 errata-xmlrpc 2026-06-11 10:53:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:25218 https://access.redhat.com/errata/RHSA-2026:25218

Comment 12 errata-xmlrpc 2026-06-12 19:51:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Via RHSA-2026:25533 https://access.redhat.com/errata/RHSA-2026:25533

Comment 13 errata-xmlrpc 2026-06-17 01:13:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:26462 https://access.redhat.com/errata/RHSA-2026:26462

Comment 14 errata-xmlrpc 2026-06-17 06:33:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:26515 https://access.redhat.com/errata/RHSA-2026:26515

Comment 15 errata-xmlrpc 2026-06-17 09:18:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:26535 https://access.redhat.com/errata/RHSA-2026:26535