Technical Summary

CVE-2026-23193 is a use-after-free vulnerability in the Linux kernel's SCSI target iSCSI code, specifically in the iscsit_dec_session_usage_count() function. The function calls complete() while holding a session usage lock, which can cause a race condition where the session structure is freed prematurely by a waiter thread waking up. This leads to a kernel address sanitizer (KASAN) slab-use-after-free error when the current thread attempts to unlock a spinlock on a freed session structure. The fix involves releasing the session usage lock before calling complete(), ensuring no further dereferences occur on the session pointer before deallocation. The vulnerability affects multiple Linux kernel versions prior to the patched versions listed in Ubuntu advisories. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Ubuntu has released updated kernel packages addressing this and other vulnerabilities. Users must reboot after updating and recompile third-party kernel modules due to ABI changes.