LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23216 is a Linux kernel flaw in the iSCSI target code. A connection cleanup race can access already-freed kernel memory. The public record gives no CVSS score, impact rating, or exploitation evidence, so urgency depends on whether systems run the affected kernel code and vendor patch availability.

Executive priority

Treat as a kernel maintenance item with higher priority for storage platforms using Linux iSCSI target. Do not classify as emergency solely from current sources because severity, CVSS, and exploitation evidence are absent.

Technical view

In iscsit_dec_conn_usage_count(), complete() was called while conn->conn_usage_lock was held. A waiter such as iscsit_close_connection() could wake, free the iscsit_conn, and leave the original thread calling spin_unlock_bh() on freed memory. The fix releases the spinlock before complete().

Likely exposure

Most relevant exposure is Linux systems using the kernel iSCSI target functionality, such as storage hosts or appliances. The source bundle lists Linux affected versions but does not map them to distributions, products, configurations, or reachable attack paths.

Exploitation context

The source bundle says KEV is false and provides no evidence of active exploitation, public weaponization, or remote exploitability. The issue was found as a KASAN slab-use-after-free during connection cleanup timing.

Researcher notes

Evidence supports a race-triggered kernel use-after-free in iSCSI target connection teardown. The public record does not establish exploit prerequisites, attacker location, required privileges, confidentiality impact, or availability impact. Validate exposure through kernel configuration and vendor backport status.

Mitigation direction

  • Apply Linux stable or distribution kernel updates containing the referenced fix.
  • Prioritize systems providing iSCSI target services or storage infrastructure roles.
  • If updates are unavailable, follow vendor guidance for supported temporary mitigations.
  • Track distribution advisories because upstream kernel versions may differ from packaged kernels.

Validation and detection

  • Inventory Linux kernel versions across storage and virtualization hosts.
  • Identify systems using the in-kernel iSCSI target functionality.
  • Confirm vendor kernels include the upstream fix or equivalent backport.
  • Review logs or crash reports for KASAN or kernel use-after-free indicators.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23216 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01, e48354ce078c079996f89d715dfa44814b4eba01unaffected
LinuxLinux3.1, 0, 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.