CVE-2026-23292

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix recursive locking in __configfs_open_file()

In flush_write_buffer, &p->frag_sem is acquired and then the loaded store

function is called, which, here, is target_core_item_dbroot_store(). This

function called filp_open(), following which these functions were called

(in reverse order), according to the call trace:

down_read

__configfs_open_file

do_dentry_open

vfs_open

do_open

path_openat

do_filp_open

file_open_name

filp_open

target_core_item_dbroot_store

flush_write_buffer

configfs_write_iter

target_core_item_dbroot_store() tries to validate the new file path by

trying to open the file path provided to it; however, in this case, the bug

report shows:

db_root: not a directory: /sys/kernel/config/target/dbroot

indicating that the same configfs file was tried to be opened, on which it

is currently working on. Thus, it is trying to acquire frag_sem semaphore

of the same file o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References