CVE-2026-72083

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT

parameter list with transport_kmap_data_sg() and parses the destination

TransportID with target_parse_pr_out_transport_id(). For an iSCSI

TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns

the ISID in iport_ptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transport_kunmap_data_sg() before

dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and

core_scsi3_alloc_registration(). When the parameter list spans more than

one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses

vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual

address backing iport_ptr is torn down and every subsequent dereference is

a use-after-free read of the unmapped region.

Keep the parameter lis

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References