Linux kernel iSCSI target: use-after-free on session teardown when complete() is called under the lock

Impact

iscsit_dec_session_usage_count() calls complete() while still holding sess->session_usage_lock. The waiter on the session release path can wake, free the iscsit_session structure, and leave the first thread unlocking a spinlock inside freed memory - a KASAN slab-use-after-free. This lives in the in-kernel iSCSI target (LIO), so it affects storage servers exporting block volumes to a GPU fleet, not the GPU nodes. The practical outcome is a crash of the storage head during session teardown, which drops every initiator's volumes at once; the record does not demonstrate controlled exploitation.

Who can reach it

Reachable from the iSCSI data path: an initiator that can open and tear down sessions against the target drives the refcount path. Whether an unauthenticated initiator can reach it depends on the target's ACLs and CHAP configuration; the record does not state authentication requirements.

What to do

Update the kernel on iSCSI target hosts to a build containing the session_usage_lock fix (commits in the record) and reboot the target, failing over to the HA peer first if there is one - an iSCSI target reboot drops all exported LUNs. Restrict initiator ACLs to known hosts in the meantime. No fixed release version is named beyond the listed commits. Closely related to the connection-count variant fixed separately.

References

Related entries

• Linux kernel iSCSI target: use-after-free on connection close when complete() is called under the lockCVE-2026-23216 · Linux kernel iSCSI target (iscsit_dec_conn_usage_count)High
• MUNGE (munged credential daemon): This is the root of trust under Slurm. A crafted message with an oversizedCVE-2026-25506 · MUNGE (munged credential daemon)High
• Linux kernel ceph client: uninitialized ceph_path_info leads to freeing an object from the wrong slab cacheCVE-2026-43408 · Linux kernel CephFS client (ceph_path_info initializers)High
• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High
• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High