CVE-2026-64103 Overview
CVE-2026-64103 is a use-after-free vulnerability in the Linux kernel isci SCSI driver, specifically within the device removal path. The completion tasklet initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) can continue running against a freed ihost structure during controller teardown. Because interrupts remain enabled until isci_host_stop_complete() executes, the MSI-X and legacy interrupt handlers in drivers/scsi/isci/host.c can requeue the tasklet after teardown starts. The stale callback may then dereference ihost and access ihost->smu_registers after the host lifetime ends, corrupting kernel memory.
Critical Impact
A race between isci_host_deinit() and the completion tasklet allows use-after-free access to freed host structures during driver unload or device removal, potentially leading to kernel memory corruption and denial of service.
Affected Products
- Linux kernel versions containing the isci SCSI driver prior to the referenced stable patches
- Systems using Intel C600 series SAS controllers managed by the isci driver
- Stable kernel branches receiving the fix commits 1412995e, 309c6058, 6d40f2f1, a83d3e4d, ab226660, b52a8d52, b9ff8631, and cb9e72c5
Discovery Timeline
- 2026-07-19 - CVE-2026-64103 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64103
Vulnerability Analysis
The isci driver initializes a completion tasklet during host allocation and schedules it from both MSI-X and legacy interrupt handlers. During teardown, isci_host_deinit() stops the controller and waits for stop completion but never calls tasklet_kill() on completion_tasklet before continuing teardown. This creates a window where the tasklet can execute against freed memory.
A naive fix placing tasklet_kill() at the top of the deinit function is insufficient. Interrupts are only disabled once isci_host_stop_complete() runs, so the IRQ handlers can requeue the tasklet until wait_for_stop() returns. The tasklet callback itself re-enables interrupts after draining completions, keeping the race window open if the kill happens before the interrupt source is quiesced.
Root Cause
The root cause is improper ordering of teardown operations in a driver with an asynchronous scheduling source. The tasklet's scheduling source, the interrupt handler, must be quiesced before killing the tasklet. Without this ordering, a queued tasklet can run on a dead ihost, dereferencing freed memory and touching hardware registers through ihost->smu_registers [CWE-416].
Attack Vector
Triggering the vulnerability requires driver unload or SAS controller removal while I/O completion activity is in flight. This is typically a local operation requiring privileges to unload kernel modules or trigger PCI device removal. A UML plus KASAN reproducer confirmed the failure class both without any tasklet_kill() call and with the kill placed before source quiesce.
The vulnerability is described in prose because no public exploitation code exists. See the referenced kernel stable patches for the corrected teardown sequence.
Detection Methods for CVE-2026-64103
Indicators of Compromise
- KASAN reports flagging use-after-free reads or writes in isci_host_deinit() or the ISCI completion tasklet callback
- Kernel oops or panic messages referencing ihost, smu_registers, or ISCI tasklet functions during driver unload or PCI hot-remove events
- Unexpected system crashes correlated with rmmod isci or SAS controller removal on affected hardware
Detection Strategies
- Enable KASAN in test kernels running the isci driver and exercise driver unload paths under sustained I/O load
- Monitor kernel logs for stack traces originating in drivers/scsi/isci/host.c around lines 223 and 613 near IRQ handler paths
- Track kernel version and patch level across fleet inventory to identify hosts still exposed to the unpatched race
Monitoring Recommendations
- Collect kernel crash dumps and dmesg output from systems using Intel C600 series SAS hardware
- Alert on module unload events for the isci driver in production environments
- Correlate hardware removal events with kernel warnings using centralized log aggregation
How to Mitigate CVE-2026-64103
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the kernel.org commit list for your kernel branch
- Identify all systems running the isci driver by checking lsmod | grep isci and prioritize patching hosts with attached SAS storage
- Avoid unloading the isci module or triggering PCI hot-remove on affected controllers until patches are deployed
Patch Information
The fix places tasklet_kill(&ihost->completion_tasklet) after wait_for_stop() returns, ensuring no further IRQ-driven scheduling can occur before the tasklet is killed. This mirrors the approach in commit f6ab594672d4 for the aic94xx driver but requires the kill after quiescing the interrupt source. Stable branch patches are available at commits 1412995e, 309c6058, 6d40f2f1, a83d3e4d, ab226660, b52a8d52, b9ff8631, and cb9e72c5.
Workarounds
- Blacklist the isci module on systems that do not require Intel C600 SAS functionality by adding blacklist isci to /etc/modprobe.d/
- Restrict module unload capability by setting kernel.modules_disabled=1 after boot on production systems that do not require dynamic module management
- Schedule maintenance windows for controller removal only after applying the patched kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
