CVE-2026-23292: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23292 is a recursive locking vulnerability in the Linux kernel's SCSI target configfs implementation, classified as a denial-of-service flaw. It affects the Linux kernel across multiple stable branches, including versions 5.3.1 through 6.1.167, 6.2 through 6.6.130, 6.7 through 6.12.77, 6.13 through 6.18.17, and 6.19 through 6.19.7, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.126.1-1. The vulnerability was published on March 25, 2026, with patches released by Red Hat and Microsoft shortly thereafter. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a recursive semaphore acquisition (CWE-764: Multiple Locks of a Critical Resource; CWE-674: Uncontrolled Recursion) in the target_core_item_dbroot_store() function within the Linux kernel's SCSI target subsystem. When a write to the configfs dbroot file is processed, flush_write_buffer() acquires the frag_sem semaphore and then calls target_core_item_dbroot_store(), which in turn calls filp_open() to validate the provided file path. If the supplied path resolves to the same configfs file currently being written (e.g., /sys/kernel/config/target/dbroot), filp_open() triggers __configfs_open_file(), which attempts to re-acquire the already-held frag_sem, resulting in a deadlock. The fix replaces filp_open() with kern_path() to perform path validation without invoking the configfs file-open path (Red Hat CVE, Feedly).

Successful exploitation causes a kernel deadlock or system hang, resulting in a denial of service. A local user with low privileges (non-root) can render the affected system unresponsive by writing a self-referential path to the configfs dbroot file, preventing the kernel from processing further requests. There is no impact on confidentiality or integrity; the availability impact is rated High (Red Hat CVE, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to write to the configfs target dbroot file (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing deadlock warnings or lockdep splats referencing frag_sem, __configfs_open_file, flush_write_buffer, or target_core_item_dbroot_store.
• System Behavior: System becomes unresponsive or hangs, particularly following writes to /sys/kernel/config/target/dbroot.
• Process: Processes blocked indefinitely in D (uninterruptible sleep) state related to configfs or SCSI target operations, visible via ps aux or top.

Update the Linux kernel to a patched stable version: 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later. Downstream distributions including Red Hat, SUSE (SUSE-SU-2026:1661-1, SUSE-SU-2026:2068-1), Debian (DSA-6238-1, DSA-6243-1, DLA-4561-1), and Amazon Linux 2023 (ALAS2023-2026-1543, ALAS2023-2026-1596, ALAS2023-2026-1681) have released updated packages. As a workaround, restrict write access to configfs target directories (e.g., /sys/kernel/config/target/) to trusted administrative users only (Red Hat CVE, SUSE Advisory, Feedly).