CVE-2026-23193: Linux Kernel iSCSI Use-After-Free Flaw

CVE-2026-23193 Overview

CVE-2026-23193 is a use-after-free vulnerability in the Linux kernel's iSCSI target subsystem. The flaw exists in the iscsit_dec_session_usage_count() function, where a race condition can lead to accessing deallocated memory. When the function calls complete() while still holding the sess->session_usage_lock, a waiting thread (such as in the session release path) may wake up and free the iscsit_session structure before the current thread finishes executing spin_unlock_bh() on the session structure.

This creates a dangerous scenario where the kernel attempts to access memory that has already been freed, resulting in a KASAN slab-use-after-free error. This type of memory corruption vulnerability can potentially lead to kernel crashes, denial of service conditions, or in some cases, privilege escalation if an attacker can control the contents of the freed memory region.

Critical Impact

Use-after-free vulnerability in the Linux kernel iSCSI target subsystem could lead to system instability, kernel crashes, or potential privilege escalation on systems running iSCSI target services.

Affected Products

• Linux Kernel (multiple stable versions)
• Systems running iSCSI target services
• Enterprise storage servers utilizing Linux iSCSI targets

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23193 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23193

Vulnerability Analysis

The vulnerability resides in the iSCSI target driver within the Linux kernel, specifically in the session usage count decrement logic. The iscsit_dec_session_usage_count() function is responsible for managing reference counting on iSCSI sessions. When this counter reaches zero, the session may be freed.

The problematic code flow occurs when multiple threads interact with the session lifecycle:

1. Thread A holds sess->session_usage_lock and decrements the usage count
2. Thread A calls complete() to signal a waiter while still holding the lock
3. Thread B (the waiter) wakes up immediately and proceeds to free the session structure
4. Thread A attempts to call spin_unlock_bh() on the now-deallocated session structure

This race window, though potentially small, can be triggered under specific timing conditions, particularly on multi-core systems with concurrent iSCSI session management operations.

Root Cause

The root cause is improper lock ordering and premature signaling in the session cleanup path. The complete() function is called before releasing the session_usage_lock, allowing the signaled waiter to proceed with deallocation while the lock is still held. This violates the principle that all references to a structure must be completed before signaling its availability for deallocation.

The fix involves reordering the operations: releasing the session_usage_lock before calling complete(). This ensures that all dereferences of the sess pointer are finished before the waiter is allowed to proceed with freeing the session structure.

Attack Vector

Exploitation of this vulnerability would require:

1. Access to a system running iSCSI target services
2. The ability to trigger concurrent iSCSI session establishment and teardown operations
3. Precise timing to win the race condition between session release and lock operations

While the attack vector complexity is relatively high due to the race condition nature, skilled attackers could potentially leverage this for local denial of service or, with heap manipulation techniques, potentially achieve privilege escalation. The vulnerability is most likely to manifest as kernel panics or memory corruption during heavy iSCSI session management activity.

The flaw affects the SCSI target subsystem, which is commonly used in enterprise storage environments. Systems serving as iSCSI targets for storage area networks (SANs) are the primary targets for this vulnerability.

Detection Methods for CVE-2026-23193

Indicators of Compromise

• KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free in iSCSI target code paths
• Kernel crashes or panics with stack traces referencing iscsit_dec_session_usage_count() or related iSCSI session management functions
• Unusual system instability during high-volume iSCSI session operations
• Kernel log messages indicating memory corruption in the SCSI target subsystem

Detection Strategies

• Enable KASAN in development/test kernels to detect use-after-free conditions during iSCSI session stress testing
• Monitor kernel logs for oops/panic messages containing iSCSI target subsystem references
• Implement kernel lockdep debugging to identify potential lock ordering issues
• Deploy crash dump analysis tools to capture and analyze kernel crashes related to iSCSI sessions

Monitoring Recommendations

• Configure kdump or crash kernel for automatic kernel crash dump collection
• Set up automated alerting for kernel panic events on iSCSI target servers
• Monitor iSCSI session connection/disconnection rates for anomalous patterns
• Implement centralized logging for kernel messages across all systems running iSCSI target services

How to Mitigate CVE-2026-23193

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix for this vulnerability
• If immediate patching is not possible, consider temporarily disabling iSCSI target services on critical systems
• Review and prioritize patching for systems actively serving as iSCSI targets
• Enable additional kernel hardening options such as SLAB_FREELIST_HARDENED if available

Patch Information

The vulnerability has been addressed through multiple kernel commits that reorder the lock release and completion signaling operations. The fix ensures that session_usage_lock is released before complete() is called, preventing the use-after-free condition.

Patched versions are available through the following kernel git commits:

• Kernel Git Commit 11ebafff
• Kernel Git Commit 2b64015
• Kernel Git Commit 41b86a9
• Kernel Git Commit 4530f4e
• Kernel Git Commit 84dc603
• Kernel Git Commit d8dbdc1
• Kernel Git Commit fd8b090

Organizations should update to the latest stable kernel version from their distribution vendor that includes these fixes.

Workarounds

• Limit iSCSI target access to trusted networks and clients only using firewall rules
• Reduce concurrent iSCSI session operations where possible to minimize race condition exposure
• Implement network segmentation to isolate iSCSI target systems from untrusted networks
• Consider using alternative storage protocols temporarily if iSCSI target services can be deferred until patching

# Restrict iSCSI target port access to trusted networks only
iptables -A INPUT -p tcp --dport 3260 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3260 -j DROP

# Check current kernel version for patch status
uname -r

# Verify iSCSI target module is loaded (if running iSCSI target services)
lsmod | grep iscsi_target