GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23193 (GCVE-0-2026-23193)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-08-05 12:20
VLAI
Title
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:19 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 2b64015550a13bcc72910be0565548d9a754d46d (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < fd8b0900173307039d3a84644c2fee041a7ed4fb (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < d8dbdc146e9e9a976931b78715be2e91299049f9 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 11ebafffce31efc6abeb28c509017976fc49f1ca (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 41b86a9ec037bd3435d68dd3692f0891a207e7e7 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 4530f4e4d0e6a207110b0ffed0c911bca43531a4 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 84dc6037390b8607c5551047d3970336cb51ba9a (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.250 , ≤ 5.10.* (semver)
Unaffected: 5.15.200 , ≤ 5.15.* (semver)
Unaffected: 6.1.163 , ≤ 6.1.* (semver)
Unaffected: 6.6.124 , ≤ 6.6.* (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:19:30.330319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:19:39.064Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.250",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.250",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\nAC:L - The race condition is inherent in the code path \u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:35.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"
        }
      ],
      "title": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23193",
    "datePublished": "2026-02-14T16:27:20.251Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-08-05T12:20:35.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23193",
      "date": "2026-09-19",
      "epss": "0.0025",
      "percentile": "0.1667"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/target/iscsi/iscsi_target_util.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a",
                    "status": "affected",
                    "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/target/iscsi/iscsi_target_util.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.1"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.250",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.200",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.124",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.70",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A068B57-89F0-436B-8831-F30BCBF37F20",
                    "versionEndExcluding": "5.10.250",
                    "versionStartIncluding": "3.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D16F6370-B70F-471C-8363-3A17B0BB1DA9",
                    "versionEndExcluding": "5.15.200",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9C856E1-4308-4C0B-A973-7DD375DF66C4",
                    "versionEndExcluding": "6.1.163",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76183B9F-CABE-4E21-A3E3-F0EBF99DC3C7",
                    "versionEndExcluding": "6.6.124",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F3791390-0628-4808-99EF-1ED8ABF60933",
                    "versionEndExcluding": "6.12.70",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7156C23F-009E-4D05-838C-A2DA417B5B8D",
                    "versionEndExcluding": "6.18.10",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: target: iscsi: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en iscsit_dec_session_usage_count()\n\nEn iscsit_dec_session_usage_count(), la funci\u00f3n llama a complete() mientras mantiene el sess-\u0026gt;session_usage_lock. Similar a la l\u00f3gica de conteo de uso de la conexi\u00f3n, el hilo en espera se\u00f1alado por complete() (por ejemplo, en la ruta de liberaci\u00f3n de la sesi\u00f3n) puede despertar y liberar la estructura iscsit_session inmediatamente.\n\nEsto crea una condici\u00f3n de carrera donde el hilo actual puede intentar ejecutar spin_unlock_bh() en una estructura de sesi\u00f3n que ya ha sido desasignada, lo que resulta en un KASAN slab-uso despu\u00e9s de liberaci\u00f3n.\n\nPara resolver esto, liberar el session_usage_lock antes de llamar a complete() para asegurar que todas las desreferencias del puntero sess hayan terminado antes de que se permita al hilo en espera proceder con la desasignaci\u00f3n."
          }
        ],
        "id": "CVE-2026-23193",
        "lastModified": "2026-06-17T10:21:04.390",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-23193",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:19:30.330319Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-02-14T17:15:57.123",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-12T02:58:30+00:00",
      "cve": "CVE-2026-23193",
      "id": "CVE-2026-23193",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:fixed": "2391",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23193.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:37:56Z",
      "cve": "CVE-2026-23193",
      "id": "CVE-2026-23193",
      "initial_release_date": "2026-02-16T00:25:14Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "698",
      "product_status:known_not_affected": "3",
      "product_status:recommended": "435",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23193",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23193.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-23193",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T20:19:30.330319Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T20:19:35.732Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/target/iscsi/iscsi_target_util.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "2b64015550a13bcc72910be0565548d9a754d46d",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "fd8b0900173307039d3a84644c2fee041a7ed4fb",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "d8dbdc146e9e9a976931b78715be2e91299049f9",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "11ebafffce31efc6abeb28c509017976fc49f1ca",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "41b86a9ec037bd3435d68dd3692f0891a207e7e7",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "4530f4e4d0e6a207110b0ffed0c911bca43531a4",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                },
                {
                  "lessThan": "84dc6037390b8607c5551047d3970336cb51ba9a",
                  "status": "affected",
                  "version": "e48354ce078c079996f89d715dfa44814b4eba01",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/target/iscsi/iscsi_target_util.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.1"
                },
                {
                  "lessThan": "3.1",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.250",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.200",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.163",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.124",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.70",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.250",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.200",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.163",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.124",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.70",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.10",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.19",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u003esession_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The iSCSI target is a network-facing service listening on TCP port 3260. An authenticated remote initiator can trigger session logout or reinstatement flows that reach the vulnerable function.\nAC:L - The race condition is inherent in the code path \u2014 whenever session_usage_count reaches 0 with a waiter, the UAF occurs deterministically because complete() wakes the waiter before spin_unlock_bh(). The attacker triggers this by initiating session logout, and the bug fires reliably.\nPR:L - An iSCSI initiator must authenticate (via CHAP or ACL) before establishing a session. Only authenticated sessions can trigger logout/reinstatement paths that call iscsit_dec_session_usage_count().\nUI:N - No user interaction is required. The attacker directly connects to the iSCSI target service, authenticates, and triggers session logout or reinstatement.\nS:U - The vulnerability affects the kernel within the same security authority. There is no crossing of a VM boundary or sandbox escape.\nC:H - This is a use-after-free on a kernel heap object (iscsit_session structure). UAFs allow an attacker to control freed object contents via heap spraying, potentially enabling arbitrary kernel memory reads.\nI:H - The use-after-free on the session structure enables heap spraying attacks that can achieve arbitrary write primitives and control flow hijacking in kernel context.\nA:H - The use-after-free causes a KASAN slab-use-after-free (as reported), which results in a kernel crash/oops, causing complete denial of service."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:20:35.890Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d"
            },
            {
              "url": "https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb"
            },
            {
              "url": "https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9"
            },
            {
              "url": "https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca"
            },
            {
              "url": "https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7"
            },
            {
              "url": "https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4"
            },
            {
              "url": "https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a"
            }
          ],
          "title": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-23193",
        "datePublished": "2026-02-14T16:27:20.251Z",
        "dateReserved": "2026-01-13T15:37:45.985Z",
        "dateUpdated": "2026-08-05T12:20:35.890Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.