CVE-2026-72083 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer.
The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region.
Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The Linux kernel contains a critical use-after-free vulnerability within the SCSI target subsystem, specifically affecting the iSCSI implementation during the REGISTER AND MOVE operation for Persistent Reserve OUT commands. This flaw arises from an incorrect memory management sequence in the function core_scsi3_emulate_pro_register_and_move(). The vulnerability is triggered when processing parameter lists that exceed standard page boundaries, typically those with a length greater than 4096 bytes. In such scenarios, the kernel utilizes virtual mapping via vmap to handle the scatter-gather list of data buffers. However, the code prematurely unmapped this buffer using transport_kunmap_data_sg before fully consuming all pointers derived from it, leading to access of freed or invalid memory regions.
The technical root cause lies in the lifecycle management of the mapped kernel virtual address. The function core_scsi3_emulate_pro_register_and_move() initially maps the PERSISTENT RESERVE OUT parameter list using transport_kmap_data_sg(). It then proceeds to parse the destination TransportID, specifically for iSCSI identifiers where the format code is 01b. During this parsing phase, the helper function iscsi_parse_pr_out_transport_id extracts the Initiator Session ID (ISID) and stores it in a pointer variable named iport_ptr. Crucially, this pointer does not contain copied data but rather points directly into the mapped buffer region provided by transport_kmap_data_sg(). Immediately after extracting this pointer, the code invokes transport_kunmap_data_sg(), which tears down the virtual mapping if vmap was used. Subsequently, the function attempts to dereference iport_ptr in several critical operations including strcmp for string comparison, __core_scsi3_locate_pr_reg for locating existing registrations, and core_scsi3_alloc_registration for allocating new registration structures. Because the underlying memory has been unmapped or freed by this point, these dereferences constitute a use-after-free read against an invalid kernel virtual address space.
This vulnerability poses significant operational risks to system stability and security. Accessing unmapped kernel memory typically results in immediate kernel panics or oopses, causing denial of service for the affected storage target node. In more complex scenarios involving specific memory allocator states or subsequent reuse of the freed pages by other subsystems, this use-after-free condition could potentially be exploited to achieve arbitrary code execution with kernel privileges. The issue is particularly relevant in environments where large SCSI parameter lists are transmitted over iSCSI networks, as it requires a payload size exceeding 4096 bytes to trigger the vmap path that exposes the bug. Attackers capable of sending crafted SCST commands could leverage this flaw to crash the host system or potentially escalate privileges if they can control the contents of the reallocated memory pages.
The remediation strategy involves correcting the scope of the buffer mapping to ensure it remains valid for the entire duration of its usage within the function. The fix removes the premature call to transport_kunmap_data_sg() that occurred before the dereferencing operations. Instead, the parameter list is kept mapped until iport_ptr and all other derived pointers are no longer needed. The unmapping operation is deferred to occur only once on the success path, immediately prior to returning from the function. Error paths continue to handle unmapping through an existing cleanup label that checks for a valid buffer pointer before invoking transport_kunmap_data_sg. This adjustment ensures that memory safety is maintained throughout all execution branches without introducing new race conditions or locking issues, as the map and unmap operations remain outside of spinlocks while reads occur under appropriate lock protection.
From a classification perspective, this vulnerability aligns with CWE-416 Use After Free, which describes situations where software continues to use memory after it has been freed, leading to undefined behavior. The attack vector involves sending maliciously crafted network packets containing oversized SCSI parameter lists, placing the issue within the context of ATT&CK technique T1059 Command and Scripting Interpreter if viewed through the lens of initial access via protocol exploitation, though more accurately classified under privilege escalation or denial of service depending on the outcome. The fix exemplifies proper resource management in kernel drivers by ensuring that allocated resources are released only after all dependent operations have completed safely. This case highlights the importance of careful pointer lifetime tracking when dealing with dynamically mapped memory regions in high-performance storage subsystems like Linux SCSI target core.