Linux kernel SCSI target: use-after-free reading the iSCSI ISID after the PR OUT parameter list is unmapped

Impact

core_scsi3_emulate_pro_register_and_move() parses an iSCSI TransportID and keeps iport_ptr as a raw pointer into the mapped PERSISTENT RESERVE OUT parameter list, then unmaps that buffer before dereferencing the pointer in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list exceeds one page the mapping was made with vmap(), so the unmap tears down the kernel virtual address and every later read hits unmapped memory. Persistent reservations are exactly what shared-LUN setups use, so this is reachable on the storage nodes that back clustered filesystems and boot LUNs for a GPU fleet. The practical outcome is an oops on the target node, taking its LUNs away from every initiator at once.

Who can reach it

An authenticated SCSI initiator with access to a LUN on the target that can issue PERSISTENT RESERVE OUT / REGISTER AND MOVE with a parameter list longer than 4096 bytes carrying an iSCSI-format TransportID.

What to do

Apply the stable-kernel fix, which keeps the parameter list mapped until iport_ptr is no longer needed and unmaps once on the success path. Kernel update plus reboot on every node running the LIO target; schedule around the initiators that depend on its LUNs. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel LIO target: unbounded iSCSI TransportID parse in PR OUT reads past the parameter bufferCVE-2026-72084 · Linux kernel LIO SCSI target (PERSISTENT RESERVE OUT TransportID parsing, iSCSI FORMAT CODE 01b)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: The sibling of theCVE-2026-72130 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical
• Linux kernel sunrpc: TLS handshake cancel race re-enters the handshake and corrupts the completion queueCVE-2026-72221 · Linux kernel sunrpc (svc_tcp_handshake TLS cancellation race)Critical
• Linux kernel sunrpc: svc_sock freed while the TLS handshake callback is still writing to itCVE-2026-72222 · Linux kernel sunrpc (svc_xprt lifetime across the asynchronous TLS handshake callback)Critical
• Linux kernel SUNRPC client: use-after-free on the upper rpc_clnt when a TLS mount handshake fails fatallyCVE-2026-72317 · Linux kernel SUNRPC client (xs_tcp_tls_setup_socket, upper rpc_clnt lifetime)Critical