Linux LIO iSCSI target: LUN_RESET on a WRITE_PENDING command deadlocks the target worker thread

Impact

When a LUN_RESET aborts a WRITE command sitting in TRANSPORT_WRITE_PENDING, the target core sets CMD_T_ABORTED and waits for the frontend. The iSCSI frontend consumed and dumped the remaining dataout PDUs but never triggered completion, so the abort path blocked forever in target_put_cmd_and_wait() and deadlocked a target worker thread. For an operator this is a hang in the box that exports block storage over iSCSI - one stuck worker degrades or stalls LUN service to every initiator behind it, and clearing it means rebooting the target host, which takes the storage away from every node mounting it. The trigger is an ordinary initiator sequence (a LUN reset followed by the remaining dataout PDUs), so any initiator that can talk to the portal can provoke it. No CVSS score is in the record.

Who can reach it

Any iSCSI initiator that can reach the target portal and is permitted to the LUN - so authentication depends on your ACL and CHAP configuration, and on a flat storage VLAN that is effectively anyone on that network. No local access to the target host is needed.

What to do

Update the target host to a stable kernel that calls target_complete_cmd() for the final dataout PDU of an aborted WRITE (four stable commits listed) and reboot it; LIO lives in the kernel, so there is no daemon restart that fixes this and the storage export goes away for the duration. Plan for failover of anything mounting those LUNs. No distro fixed version is named in the record.

References

Related entries

• Linux kernel RDS: congestion map scatterlist overruns on >8K page sizes, corrupting the RDS-TCP streamCVE-2026-97954 · Linux kernel net/rds (RDS-TCP congestion map scatterlist length)Unscored
• Linux kernel ice: missing xa_destroy leaks xarray memory on every HW re-initCVE-2026-97979 · Linux kernel ice driver (sched_node_ids xarray teardown)Unscored
• Linux kernel vhost-vdpa: failed eventfd install leaves an ERR_PTR reachable by the config callbackCVE-2026-97993 · Linux kernel vhost-vdpa (ERR_PTR installed in v->config_ctx by VHOST_VDPA_SET_CONFIG_CALL)Unscored
• Linux kernel vhost-vdpa: queue size is not checked against the device maximum, giving an out-of-bounds descriptor readCVE-2026-97994 · Linux kernel vhost-vdpa (VHOST_SET_VRING_NUM validation)Unscored
• Linux kernel BPF verifier (bpf_loop nr_loops argument type): bpf_loop() declared nr_loops as ARG_ANYTHING, so aCVE-2026-98007 · Linux kernel BPF verifier (bpf_loop nr_loops argument type)Unscored
• Linux kernel BPF: bpf_btf_find_by_name_kind() can sleep in softirq context and install an fd into the interrupted taskCVE-2026-98046 · Linux kernel BPF helper bpf_btf_find_by_name_kind() (missing sleepable annotation)Unscored