unknown

CVE-2026-99206

A race condition in the Linux kernel's iSCSI target discovery module allows concurrent configfs operations to trigger a double-free vulnerab

Overview

A race condition in the Linux kernel's iSCSI target discovery module allows concurrent configfs operations to trigger a double-free vulnerability. This flaw occurs when multiple processes simultaneously update the discovery AuthMethod parameter without proper synchronization. It poses a stability and security risk to systems exposing iSCSI targets via the kernel's target subsystem.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.

Impact

The vulnerability primarily affects the Integrity and Availability of systems running the Linux kernel with the iSCSI target subsystem enabled. An attacker with local access or the ability to manipulate configfs parameters could potentially trigger a kernel crash or memory corruption. Confidentiality is not directly impacted, but denial of service is a significant concern for storage infrastructure. Systems acting as iSCSI targets are the primary risk surface.

Remediation

Apply the latest kernel patch that introduces the discovery TPG access lock to serialize configfs parameter updates. If immediate patching is not possible, restrict access to the configfs interface for the iSCSI target subsystem to trusted administrative accounts only. Monitor system logs for unexpected kernel panics or memory corruption errors related to the iSCSI target module.

Risk context

The severity is currently unknown as no CVSS score or EPSS probability has been assigned. Given the local nature of the trigger and the specific configuration required (iSCSI target with configfs access), the immediate risk is moderate for typical deployments but higher for exposed storage gateways. Defenders should prioritize patching in environments where the iSCSI target is actively used and configfs is accessible.

Affected products

  • Linux Kernel
  • Linux iSCSI Target
  • configfs

Scores

Severity
unknown
CVSS v2
—
CVSS v3
—
CVSS v4
—
EPSS
—

linux-kernel race-condition double-free iscsi configfs memory-corruption

← All CVEs

Related CVEs

unknown

CVE-2026-120988

billboard.js before 4.1.3 is vulnerable to cross‑site scripting due to improper sanitization of series ids during legend template rendering. An attacker can inject malicious JavaScript when the chart is rendered, potentially compromising the web application. The flaw affects any site that uses billboard.js for data visualization.

View analysis

unknown

CVE-2026-119341

Tesseract OCR engine before 5.5.4 can suffer memory corruption when processing a pre‑adapted template file, leading to a denial‑of‑service. The flaw occurs in ReadAdaptedClass when legacy mode is enabled and attacker‑controlled .a files are parsed. It affects all Tesseract 5.x releases that allow pre‑adapted templates.

View analysis

unknown

CVE-2026-99188

A vulnerability in the Linux kernel's stmmac network driver causes an interrupt storm during system resume from sleep states. This occurs because the RGMII status interrupt is not cleared, leading to CPU starvation and potential system hangs or watchdog resets on affected hardware.

View analysis

unknown

CVE-2026-99148

A reference counting flaw in the Linux kernel's amdgpu driver allows a Buffer Object (BO) to be evicted while user-space GPU queues still hold active mappings. This occurs because the eviction fence is detached when any handle to the BO is closed, rather than only when the last reference to the underlying virtual address space is released. The issue can lead to use-after-free conditions or GPU hangs on systems using AMD graphics hardware.

View analysis