CVE-2023-54184: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54184 is a use-after-free and null pointer dereference vulnerability in the Linux kernel's iSCSI target subsystem (scsi/target/iscsit). The flaw occurs because commands from recovery entries are freed after the iSCSI session has already been closed, leading to memory corruption or a kernel NULL pointer dereference. It affects the Linux kernel across multiple stable branches and was publicly disclosed on December 30, 2025. No CVSS score has been assigned as of the time of this report (ENISA EUVD, Feedly).

The root cause is a race condition / improper resource lifecycle management (CWE-416: Use After Free) in the iscsit_close_session() function within the Linux kernel's iSCSI target module (iscsi_target_mod). When the Time2Retain timer expires and triggers session cleanup, iscsit_free_connection_recovery_entries() is called after the session has been freed, causing iscsit_free_cmd() → transport_generic_free_cmd() → target_release_cmd_kref() → sbitmap_queue_clear() to dereference a NULL or already-freed pointer. The fix moves the cleanup of recovery entries to occur before session freeing, resolving the ordering issue. Patches are available for multiple stable kernel branches (ENISA EUVD, Kernel Git).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference or use-after-free, resulting in a kernel panic (system crash) and denial of service on the affected host. Because the flaw resides in kernel space, it could theoretically be leveraged for local privilege escalation or memory corruption, though no such exploitation has been demonstrated publicly. Systems running Linux kernel iSCSI target services (storage servers, SANs) are most at risk, as the vulnerability is triggered during iSCSI session teardown (ENISA EUVD).

Apply the upstream Linux kernel patches that move iscsit_free_connection_recovery_entries() to before session freeing. Fixed commits are available for multiple stable branches: 5.4.x (patch: 5.4.244), 5.10.x (patch: 5.10.181), 5.15.x (patch: 5.15.113), 6.1.x (patch: 6.1.30), 6.3.x (patch: 6.3.4), and 6.4. Administrators running iSCSI target services should update to a patched kernel version as soon as possible. As a temporary workaround, disabling the iSCSI target service (iscsi_target_mod) on systems where it is not required will eliminate exposure (ENISA EUVD, Kernel Git).