In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion… (CVE-2026-64103)
In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().
AI Analysis
Technical Summary
CVE-2026-64103 is a use-after-free vulnerability in the Linux kernel's ISCI SCSI driver. The ISCI completion tasklet is initialized and scheduled from interrupt handlers but was not properly killed during device removal. The teardown process did not kill the tasklet after the controller stop completed, allowing the tasklet to potentially run on a freed host structure due to a race condition. The fix involves killing the completion tasklet after wait_for_stop() returns, ensuring no further IRQ-driven scheduling can occur on a dead host. This vulnerability affects Linux kernel versions prior to the patched releases noted in Ubuntu advisories and has a CVSS 3.1 score of 7.8 (High impact on confidentiality, integrity, and availability).
Potential Impact
Successful exploitation could lead to use-after-free conditions causing system instability, crashes, or potentially arbitrary code execution with elevated privileges. The vulnerability impacts confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available and has been released by Ubuntu as part of their security updates. Users should update their Linux kernel packages to the fixed versions as specified in the Ubuntu security notices (e.g., linux-image-5.15.0-1112.119~20.04.1 or later). After updating, a system reboot is required to apply the fixes. Additionally, due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow vendor guidance for updating and recompiling kernel modules.
In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion… (CVE-2026-64103)
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().
CVSS v3.1
Score 7.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64103 is a use-after-free vulnerability in the Linux kernel's ISCI SCSI driver. The ISCI completion tasklet is initialized and scheduled from interrupt handlers but was not properly killed during device removal. The teardown process did not kill the tasklet after the controller stop completed, allowing the tasklet to potentially run on a freed host structure due to a race condition. The fix involves killing the completion tasklet after wait_for_stop() returns, ensuring no further IRQ-driven scheduling can occur on a dead host. This vulnerability affects Linux kernel versions prior to the patched releases noted in Ubuntu advisories and has a CVSS 3.1 score of 7.8 (High impact on confidentiality, integrity, and availability).
Potential Impact
Successful exploitation could lead to use-after-free conditions causing system instability, crashes, or potentially arbitrary code execution with elevated privileges. The vulnerability impacts confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available and has been released by Ubuntu as part of their security updates. Users should update their Linux kernel packages to the fixed versions as specified in the Ubuntu security notices (e.g., linux-image-5.15.0-1112.119~20.04.1 or later). After updating, a system reboot is required to apply the fixes. Additionally, due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow vendor guidance for updating and recompiling kernel modules.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2g34-2vmv-m9r2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64103"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912bbf4
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 08/22/2026, 14:29:03 UTC
Last updated: 09/01/2026, 10:52:10 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.