Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e48354ce078c079996f89d715dfa44814b4eba01 to < 2b64015550a13bcc72910be0565548d9a754d46daffectede48354ce078c079996f89d715dfa44814b4eba01 to < fd8b0900173307039d3a84644c2fee041a7ed4fbaffectede48354ce078c079996f89d715dfa44814b4eba01 to < d8dbdc146e9e9a976931b78715be2e91299049f9affectede48354ce078c079996f89d715dfa44814b4eba01 to < 11ebafffce31efc6abeb28c509017976fc49f1caaffectede48354ce078c079996f89d715dfa44814b4eba01 to < 41b86a9ec037bd3435d68dd3692f0891a207e7e7affectede48354ce078c079996f89d715dfa44814b4eba01 to < 4530f4e4d0e6a207110b0ffed0c911bca43531a4affectede48354ce078c079996f89d715dfa44814b4eba01 to < 84dc6037390b8607c5551047d3970336cb51ba9aaffected
Linux Linux
Default version status: affected
3.1affected0 to < 3.1unaffected5.10.250 to ≤ 5.10.*unaffected5.15.200 to ≤ 5.15.*unaffected6.1.163 to ≤ 6.1.*unaffected6.6.124 to ≤ 6.6.*unaffected6.12.70 to ≤ 6.12.*unaffected6.18.10 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2b64015550a13bcc72910be0565548d9a754d46d ↗
- https://git.kernel.org/stable/c/fd8b0900173307039d3a84644c2fee041a7ed4fb ↗
- https://git.kernel.org/stable/c/d8dbdc146e9e9a976931b78715be2e91299049f9 ↗
- https://git.kernel.org/stable/c/11ebafffce31efc6abeb28c509017976fc49f1ca ↗
- https://git.kernel.org/stable/c/41b86a9ec037bd3435d68dd3692f0891a207e7e7 ↗
- https://git.kernel.org/stable/c/4530f4e4d0e6a207110b0ffed0c911bca43531a4 ↗
- https://git.kernel.org/stable/c/84dc6037390b8607c5551047d3970336cb51ba9a ↗