scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().

Timeline

1. Feb 18, 2026, 2:21 PM UTCCVE published
2. Jun 10, 2026, 8:40 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 6:35 PM UTCRecord last updated

Affected versions

• Linux Linux

  From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in ba684191437380a07b27666eb4e72748be1ea201; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 8518f072fc92921418cd9ed4268dd4f3e9a8fd75; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 275016a551ba1a068a3bd6171b18611726b67110; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 73b487d44bf4f92942629d578381f89c326ff77f; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 48fe983e92de2c59d143fe38362ad17ba23ec7f3; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 3835e49e146a4e6e7787b29465f1a23379b6ec44; From e48354ce078c079996f89d715dfa44814b4eba01 · fixed in 9411a89e9e7135cc459178fa77a3f1d6191ae903

• Linux Linux

  3.1

• KernelLinux

  From 3.1.0 · fixed in 5.10.250; From 5.11.0 · fixed in 5.15.200; From 5.16.0 · fixed in 6.1.163; From 6.2.0 · fixed in 6.6.124; From 6.7.0 · fixed in 6.12.70; From 6.13.0 · fixed in 6.18.10

References 7