CVE-2026-64103 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: isci: Fix use-after-free in device removal path
The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613).
isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open.
Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends.
A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source.
This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel represents a critical use-after-free condition within the ISCI (Intel Scalable Controller Interface) SCSI driver implementation. This flaw manifests during device removal operations when the completion tasklet is not properly synchronized with the host controller teardown process. The issue stems from improper tasklet management where the completion_tasklet is initialized during host allocation but fails to be adequately terminated before the host structure is destroyed. The vulnerability specifically affects the scsi:isci driver component and has been classified as a use-after-free condition that can lead to system instability and potential security implications.
The technical root cause lies in the asynchronous nature of interrupt-driven operations within the SCSI subsystem where the ISCI completion tasklet operates independently of the main host controller shutdown sequence. The isci_host_deinit() function properly stops the controller and waits for stop completion but neglects to properly terminate the completion_tasklet before proceeding with teardown. This creates a race condition where IRQ handlers can continue scheduling the tasklet even after the host structure has been partially deallocated, leading to potential dereference of freed memory structures. The tasklet_kill() call placed at the beginning of the function proves insufficient because interrupts remain enabled during the wait_for_stop() phase, allowing for requeuing of the tasklet before proper synchronization occurs.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable privilege escalation or denial-of-service conditions in environments where SCSI devices are actively managed. When device removal occurs during active I/O operations, the stale callback can dereference the ihost structure and access ihost->smu_registers after the host lifetime has ended, creating a scenario where memory corruption may occur. This vulnerability affects systems running Linux kernels with ISCI driver support and particularly impacts server environments where SCSI storage controllers are commonly deployed. The race condition allows for execution of potentially malicious code through memory corruption or system instability that can be exploited by local attackers.
Mitigation strategies must focus on proper tasklet synchronization during host teardown operations, ensuring that completion_tasklet is killed after the scheduling source has been properly quiesced but before host structure deallocation begins. The fix implements a kill operation specifically after wait_for_stop() returns, preventing any further IRQ-driven scheduling of the tasklet and eliminating the race condition. This approach mirrors similar fixes implemented in other SCSI drivers such as the aic94xx driver referenced in commit f6ab594672d4, demonstrating a consistent pattern for addressing use-after-free conditions in interrupt-driven subsystems. The solution aligns with industry best practices for kernel memory management and follows established patterns for preventing race conditions in concurrent systems. Security teams should prioritize applying this patch to systems running affected kernel versions, particularly those managing critical SCSI storage infrastructure where device removal operations may occur during active system operation.
This vulnerability demonstrates characteristics consistent with CWE-416 Use After Free and aligns with ATT&CK techniques related to privilege escalation through memory corruption vulnerabilities. The fix addresses fundamental race condition issues that can be exploited by attackers who understand the kernel's interrupt handling mechanisms, making proper patch application critical for maintaining system security posture in enterprise environments.