Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-23292

scsi: target: Fix recursive locking in __configfs_open_file()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows: db_root: not a directory: /sys/kernel/config/target/dbroot indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking. Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b0841eefd9693827afb9888235e26ddd098f9cef to < 3161ef61f121d4573cad5b57c92188dcd9b284b3affected
  • b0841eefd9693827afb9888235e26ddd098f9cef to < e8ef82cb6443d5f3260b1b830e17f03dda4229eaaffected
  • b0841eefd9693827afb9888235e26ddd098f9cef to < 4fcfa424a581d823cb1a9676e3eefe6ca17e453aaffected
  • b0841eefd9693827afb9888235e26ddd098f9cef to < 9a5641024fbfd9b24fe65984ad85fea10a3ae438affected
  • b0841eefd9693827afb9888235e26ddd098f9cef to < 142eacb50fb903a4c10dee7e67b6e79ebb36a582affected
  • b0841eefd9693827afb9888235e26ddd098f9cef to < 14d4ac19d1895397532eec407433c5d74d9da53baffected
  • 49824b5c875087a52672b0c8e8ecbefe6f773532affected
  • 09e21253d17f53bdb5aac0e0dbd057a29fcbe8d1affected
  • 0dfc45be875a378c2a3a4d6ed8e668ec8eb75073affected
  • 4.9.201 to < 4.10affected
  • 4.14.154 to < 4.15affected
  • 4.19.84 to < 4.20affected

Linux Linux

Default version status: affected

  • 5.3affected
  • 0 to < 5.3unaffected
  • 6.1.167 to ≤ 6.1.*unaffected
  • 6.6.130 to ≤ 6.6.*unaffected
  • 6.12.77 to ≤ 6.12.*unaffected
  • 6.18.17 to ≤ 6.18.*unaffected
  • 6.19.7 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References