CVE-2026-23216: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23216 is a use-after-free vulnerability in the Linux kernel's iSCSI target module (scsi/target/iscsi) within the iscsit_dec_conn_usage_count() function. It affects Linux kernel versions from 3.1 through 6.19-rc6, with specific vulnerable ranges including versions prior to 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, and 6.18.10. The vulnerability was disclosed on February 18, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition leading to a use-after-free (CWE-416) in iscsit_dec_conn_usage_count(). The function calls complete() while still holding the conn->conn_usage_lock spinlock; once complete() is invoked, a waiting thread such as iscsit_close_connection() can immediately wake up and free the iscsit_conn structure. When the original thread subsequently attempts to execute spin_unlock_bh(), it accesses already-freed memory, triggering a KASAN slab-use-after-free error. The fix reorders operations so the spinlock is released before complete() is called, eliminating the race window (Red Hat Bugzilla, Red Hat Advisory).

A low-privileged local attacker can exploit this vulnerability to corrupt kernel slab memory, potentially leading to information disclosure, data integrity violations, or a kernel crash causing denial of service. Because the vulnerability resides in the iSCSI target subsystem, systems actively serving iSCSI targets are at elevated risk. The attack requires only local access with low privileges and no user interaction, making it accessible to any unprivileged user on an affected system (Red Hat Advisory).

Update the Linux kernel to a patched version: 5.10.250 or later, 5.15.200 or later, 6.1.163 or later, 6.6.124 or later, 6.12.70 or later, or 6.18.10 or later. Multiple upstream kernel commits address this issue (commit IDs: 275016a551ba, 3835e49e146a, 48fe983e92de, 73b487d44bf4, 8518f072fc92, 9411a89e9e71, ba684191437). Red Hat has issued errata RHSA-2026:9870, RHSA-2026:10756, RHSA-2026:22964, and RHSA-2026:23237 for affected RHEL versions. As a temporary workaround, restrict local system access to trusted users on systems running iSCSI target services (Red Hat Bugzilla, Red Hat Advisory).