CVE-2026-45857: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45857 Overview

CVE-2026-45857 is a null pointer dereference vulnerability in the Linux kernel's csiostor SCSI driver. The flaw resides in an error exit path where the pointer rn is dereferenced via the CSIO_INC_STATS macro after being confirmed as NULL. The kernel maintainers resolved the issue by adding a new error return path label that bypasses the macro invocation when rn is NULL.

Critical Impact
Triggering the affected error path can dereference a NULL pointer in kernel space, resulting in a kernel oops and denial of service on systems using Chelsio FCoE storage adapters.

Affected Products

Linux kernel scsi: csiostor driver (Chelsio FCoE storage driver)
Multiple stable kernel branches referenced by upstream commits
Distributions shipping vulnerable csiostor driver builds

Discovery Timeline

2026-05-27 - CVE-2026-45857 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45857

Vulnerability Analysis

The vulnerability exists in the csiostor driver, which supports Chelsio Fibre Channel over Ethernet (FCoE) host bus adapters. When the driver encounters a condition where the remote node pointer rn is NULL, control flow proceeds down an error exit path. That error path invokes the CSIO_INC_STATS macro on the NULL rn pointer to increment a statistics counter associated with the remote node structure. Because the macro accesses a member of the structure pointed to by rn, the dereference triggers an invalid memory access in kernel context.

This class of defect falls under null pointer dereference [CWE-476]. In kernel-mode code paths, dereferencing a NULL pointer typically produces a kernel oops or panic depending on the configuration of panic_on_oops. The upstream fix introduces a new return label placed before the CSIO_INC_STATS invocation so that the NULL-rn branch bypasses the macro entirely.

Root Cause

The root cause is a control-flow ordering defect in the error handling block. The original code path did not separate the statistics increment, which requires a valid rn, from the generic error return logic. As a result, the failure case that produced the NULL rn reached code that assumed the pointer was valid.

Attack Vector

The attack vector requires local code paths that drive the csiostor driver into the failing condition. The issue is reachable only on hosts with the affected Chelsio FCoE hardware and driver loaded. Successful triggering produces a kernel-level fault rather than memory corruption or privilege escalation.

No exploitation code is publicly verified for this CVE. The vulnerability is described in prose only; readers can review the upstream commits for the exact source-level change.

Detection Methods for CVE-2026-45857

Indicators of Compromise

Kernel oops or panic messages referencing csiostor functions in dmesg or /var/log/kern.log
Stack traces containing CSIO_INC_STATS or csiostor remote node handling routines
Unexpected restarts on hosts with Chelsio FCoE adapters and the csiostor module loaded

Detection Strategies

Inventory kernel versions across Linux fleet and compare against the patched commits listed in the upstream references
Check whether the csiostor module is present and loaded using lsmod | grep csiostor
Correlate kernel crash dumps from kdump or kexec with the csiostor call stack signature

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on kernel oops events
Monitor host availability metrics for hosts equipped with Chelsio FCoE adapters
Track package and kernel update status across affected distributions to confirm patch deployment

How to Mitigate CVE-2026-45857

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commits for scsi: csiostor: Fix dereference of null pointer rn
Update to a distribution kernel that incorporates the fix on hosts running the csiostor driver
If patching is not immediately possible and FCoE is not required, unload the csiostor module to remove the vulnerable code path

Patch Information

The fix has been merged into multiple stable kernel branches. The relevant upstream commits include Kernel Git Commit 16ccbfdd, Kernel Git Commit 19822575, Kernel Git Commit 25ab5e97, Kernel Git Commit 25d623f0, Kernel Git Commit 3bbbab7b, Kernel Git Commit 44ef9f81, Kernel Git Commit 526ea3c0, and Kernel Git Commit 6037124d. The fix adds a new error return label so the NULL-rn branch skips the CSIO_INC_STATS macro.

Workarounds

Blacklist the csiostor kernel module on systems that do not require Chelsio FCoE functionality
Restrict physical and administrative access to hosts containing affected hardware until patches are applied
Configure kdump to capture crash data so that any triggered fault can be analyzed and attributed quickly

bash

# Configuration example: prevent the csiostor module from loading
echo "blacklist csiostor" | sudo tee /etc/modprobe.d/blacklist-csiostor.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep csiostor