{"id":"CVE-2026-72083","summary":"scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged.","modified":"2026-10-28T14:49:24.731515464Z","published":"2026-08-15T05:52:32.045Z","related":["ALSA-2026:91565","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","SUSE-SU-2026:4279-1","SUSE-SU-2026:4282-1","SUSE-SU-2026:4284-1","SUSE-SU-2026:4369-1","SUSE-SU-2026:4639-1","SUSE-SU-2026:4665-1","SUSE-SU-2026:4667-1","openSUSE-SU-2026:21910-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72083.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72083.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72083"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4949314c7283ea4f9ade182ca599583b89f7edd6"},{"fixed":"7d56f5c868d92c9d504a34a3ea450bce481c7f63"},{"fixed":"59a2a5a37dc49a641ad6bc64aee34e5a61025ffd"},{"fixed":"9f8076cc73dfa6b10155978c160587e986b22169"},{"fixed":"a040004846f1fbe687f6ec76d9ccc27b4ead42e4"},{"fixed":"05b3e37433cf2eaf8867f1c16528aa347bb212ab"},{"fixed":"cb7bdae7fba404852ade34b0c1445fbaf3e54fbb"},{"fixed":"ef2ee18fec92088c7d8877baf7674e89389ccd66"},{"fixed":"fda6a1f3c3d7047b5ce5654487649c2daa738bfc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.2.9"},{"fixed":"3.3"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d2227f84ba0e97906153ac83db13213fb2e3938d"}]}],"versions":["v3.2.102","v3.2.101","v3.2.100","v3.2.99","v3.2.98","v3.2.97","v3.2.96","v3.2.95","v3.2.94","v3.2.93","v3.2.92","v3.2.91","v3.2.90","v3.2.89","v3.2.88","v3.2.87","v3.2.86","v3.2.85","v3.2.84","v3.2.83","v3.2.82","v3.2.81","v3.2.80","v3.2.79","v3.2.78","v3.2.77","v3.2.76","v3.2.75","v3.2.74","v3.2.73","v3.2.72","v3.2.71","v3.2.70","v3.2.69","v3.2.68","v3.2.67","v3.2.66","v3.2.65","v3.2.64","v3.2.63","v3.2.62","v3.2.61","v3.2.60","v3.2.59","v3.2.58","v3.2.57","v3.2.56","v3.2.55","v3.2.54","v3.2.53","v3.2.52","v3.2.51","v3.2.50","v3.2.49","v3.2.48","v3.2.47","v3.2.46","v3.2.45","v3.2.44","v3.2.43","v3.2.42","v3.2.41","v3.2.40","v3.2.39","v3.2.38","v3.2.37","v3.2.36","v3.2.35","v3.2.34","v3.2.33","v3.2.32","v3.2.31","v3.2.30","v3.2.29","v3.2.28","v3.2.27","v3.2.26","v3.2.25","v3.2.24","v3.2.23","v3.2.22","v3.2.21","v3.2.20","v3.2.19","v3.2.18","v3.2.17","v3.2.16","v3.2.15","v3.2.14","v3.2.13","v3.2.12","v3.2.11","v3.2.10","v3.2.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72083.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72083.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}