{"id":6762,"date":"2026-09-04T18:49:16","date_gmt":"2026-09-04T10:49:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72083"},"modified":"2026-09-04T18:49:16","modified_gmt":"2026-09-04T10:49:16","slug":"cve-2026-72083","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72083","title":{"rendered":"CVE-2026-72083 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: F"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE<\/p>\n<p>core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT<br \/>\nparameter list with transport_kmap_data_sg() and parses the destination<br \/>\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI<br \/>\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns<br \/>\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.<\/p>\n<p>The function then unmaps the buffer with transport_kunmap_data_sg() before<br \/>\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and<br \/>\ncore_scsi3_alloc_registration(). When the parameter list spans more than<br \/>\none page (PARAMETER LIST LENGTH &gt; 4096), transport_kmap_data_sg() uses<br \/>\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual<br \/>\naddress backing iport_ptr is torn down and every subsequent dereference is<br \/>\na use-after-free read of the unmapped region.<\/p>\n<p>Keep the parameter list mapped until iport_ptr is no longer needed: drop<br \/>\nthe early transport_kunmap_data_sg() and unmap once on the success path,<br \/>\nright before returning. The error paths already unmap through the existing<br \/>\n&#8220;if (buf) transport_kunmap_data_sg(cmd)&#8221; at the out: label, which now runs<br \/>\non every post-map error exit because buf is no longer cleared early. Only<br \/>\nreads of the mapping happen while spinlocks are held; the map and unmap<br \/>\ncalls remain outside any lock. The sibling caller<br \/>\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it<br \/>\nand is left unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE<\/p>\n<p>core_scsi3_emulate_pro_register_and_move() maps the PERSIST<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6762","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}