Linux kernel iSCSI target: use-after-free on connection close when complete() is called under the lock

Impact

iscsit_dec_conn_usage_count() invokes complete() while holding conn->conn_usage_lock; the waiter, typically iscsit_close_connection(), can free the iscsit_conn structure before the first thread reaches spin_unlock_bh(), giving a KASAN slab-use-after-free. This is the connection-level counterpart of the session-level bug, with a separate fix and a separate code path, so it is tracked on its own. For an operator it means the LIO iSCSI target serving block storage to the fleet can crash on connection teardown, dropping LUNs for every initiator on that head. The record shows a crash, not a demonstrated escalation.

Who can reach it

Reachable from the iSCSI data path: an initiator that opens and closes connections against the target exercises the refcount path. The record does not state whether authentication is required; in practice it depends on the target's initiator ACLs and CHAP settings.

What to do

Update the kernel on iSCSI target hosts to a build with the conn_usage_lock fix (commits in the record) and reboot the target, failing over to an HA peer first where one exists. Tighten initiator ACLs until the reboot can be scheduled. The record names no fixed release beyond the listed commits.

References

Related entries

• MUNGE (munged credential daemon): This is the root of trust under Slurm. A crafted message with an oversizedCVE-2026-25506 · MUNGE (munged credential daemon)High
• Linux kernel ceph client: uninitialized ceph_path_info leads to freeing an object from the wrong slab cacheCVE-2026-43408 · Linux kernel CephFS client (ceph_path_info initializers)High
• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High
• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High
• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High