CVE-2026-23193: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23193 is a use-after-free vulnerability in the Linux kernel's SCSI target iSCSI driver, specifically within the iscsit_dec_session_usage_count() function. The flaw was published on February 14, 2026, and affects a wide range of kernel versions: 3.1 through 5.10.249, 5.11 through 5.15.199, 5.16 through 6.1.162, 6.2 through 6.6.123, 6.7 through 6.12.69, and 6.13 through 6.18.9, as well as release candidates up to 6.19-rc6. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is improper lock ordering in iscsit_dec_session_usage_count(), classified as CWE-416 (Use After Free). The function calls complete() while still holding sess->session_usage_lock; a waiter signaled by complete() — such as a session release path — can immediately wake up and free the iscsit_session structure. The current thread then attempts to execute spin_unlock_bh() on the now-deallocated session object, triggering a KASAN slab-use-after-free error. The fix reorders operations so that session_usage_lock is released before complete() is called, ensuring all dereferences of the sess pointer complete before the waiter is permitted to proceed with deallocation (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low-level privileges to trigger kernel memory corruption via a race condition, potentially leading to kernel crashes (denial of service), arbitrary memory reads or writes, and privilege escalation to root. The vulnerability affects the availability, integrity, and confidentiality of the system at the kernel level, and could be leveraged for lateral movement or persistent access if combined with other techniques. All systems running affected Linux kernel versions with iSCSI target functionality enabled are at risk (Feedly).

Patches are available for all affected kernel branches. Administrators should update to the following fixed versions or later: Linux kernel 5.10.250+, 5.15.200+, 6.1.163+, 6.6.124+, 6.12.70+, or 6.18.10+, depending on the branch in use. Patches are available through the official Linux kernel stable git repository and have been incorporated into downstream distributions including Debian, Ubuntu, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Oracle Linux, SUSE, and Amazon Linux 2. As a temporary workaround where patching is not immediately possible, restricting access to iSCSI target functionality can reduce exposure. Prioritize patching systems that expose iSCSI targets to untrusted users (Feedly, Kernel Patch, Red Hat Advisory, Debian LTS).

The vulnerability has been addressed by a broad set of major Linux distributions, including Red Hat (RHSA-2026:6571, RHSA-2026:6632, RHSA-2026:9095, and others), Debian (DSA-6141-1, DSA-6163-1, DLA-4498-1), Ubuntu (USN-8393-1), SUSE (SUSE-SU-2026:1661-1, SUSE-SU-2026:2068-1), AlmaLinux, Rocky Linux, and Oracle Linux, reflecting broad industry recognition of the issue. Detection plugins have been published by Tenable (Nessus) and Qualys, indicating active scanner coverage. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories (Red Hat Advisory, Debian LTS, SUSE Advisory).