High 7.8Published Feb 18, 2026

CVE-2026-23216scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

Updated under an hour ago (Oct 27, 2026, 3:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e48354ce078c079996f89d715dfa44814b4eba01 before ba684191437380a07b27666eb4e72748be1ea201; from e48354ce078c079996f89d715dfa44814b4eba01 before 8518f072fc92921418cd9ed4268dd4f3e9a8fd75; from e48354ce078c079996f89d715dfa44814b4eba01 before 275016a551ba1a068a3bd6171b18611726b67110; from e48354ce078c079996f89d715dfa44814b4eba01 before 73b487d44bf4f92942629d578381f89c326ff77f; from e48354ce078c079996f89d715dfa44814b4eba01 before 48fe983e92de2c59d143fe38362ad17ba23ec7f3; from e48354ce078c079996f89d715dfa44814b4eba01 before 3835e49e146a4e6e7787b29465f1a23379b6ec44; from e48354ce078c079996f89d715dfa44814b4eba01 before 9411a89e9e7135cc459178fa77a3f1d6191ae903	CNA record
linux linux_kernel linux:linux_kernel	from 3.1 before 5.10.250; from 5.11 before 5.15.200; from 5.16 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201	patch
https://git.kernel.org/stable/c/8518f072fc92921418cd9ed4268dd4f3e9a8fd75	patch
https://git.kernel.org/stable/c/275016a551ba1a068a3bd6171b18611726b67110	patch
https://git.kernel.org/stable/c/73b487d44bf4f92942629d578381f89c326ff77f	patch
https://git.kernel.org/stable/c/48fe983e92de2c59d143fe38362ad17ba23ec7f3	patch
https://git.kernel.org/stable/c/3835e49e146a4e6e7787b29465f1a23379b6ec44	patch
https://git.kernel.org/stable/c/9411a89e9e7135cc459178fa77a3f1d6191ae903	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.