Critical 9.8Published Dec 30, 2025

CVE-2023-54184scsi: target: iscsit: Free cmds before session free

Updated under an hour ago (Oct 28, 2026, 2:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	988e3a85463d9b6dabc681df3f8f131b23c19953 builds before 89f5055f9b0b57c7e7f02e32df95ef401f809b71; from 988e3a85463d9b6dabc681df3f8f131b23c19953 before 4621e24c9257c6379343bf0c11b473817cf7edcd; from 988e3a85463d9b6dabc681df3f8f131b23c19953 before 1911cca5916b6e106de7afa3ec0a38447158216c; from 988e3a85463d9b6dabc681df3f8f131b23c19953 before a7a4def6c7046e090bb10c6d550fdeb487db98ba; 988e3a85463d9b6dabc681df3f8f131b23c19953 builds before 4ce221d295f53e6c6b835ab33181e735482c9aac; from 988e3a85463d9b6dabc681df3f8f131b23c19953 before d8990b5a4d065f38f35d69bcd627ec5a7f8330ca	CNA record

References

References

https://git.kernel.org/stable/c/89f5055f9b0b57c7e7f02e32df95ef401f809b71
https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd
https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a38447158216c
https://git.kernel.org/stable/c/a7a4def6c7046e090bb10c6d550fdeb487db98ba
https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac
https://git.kernel.org/stable/c/d8990b5a4d065f38f35d69bcd627ec5a7f8330ca

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.