---
id: CVE-2026-72083
title: 'scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

  core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
  parameter list with t…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    7d56f5c868d92c9d504a34a3ea450bce481c7f63
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    9f8076cc73dfa6b10155978c160587e986b22169
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    a040004846f1fbe687f6ec76d9ccc27b4ead42e4
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    05b3e37433cf2eaf8867f1c16528aa347bb212ab
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    ef2ee18fec92088c7d8877baf7674e89389ccd66
  - >-
    Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 <
    fda6a1f3c3d7047b5ce5654487649c2daa738bfc
  - Linux d2227f84ba0e97906153ac83db13213fb2e3938d
  - Linux >= 3.2.9 < 3.3
  - Linux 3.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:51:39.405960Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:20.055Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72083'
references:
  - url: 'https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63'
  - url: 'https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd'
  - url: 'https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169'
  - url: 'https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4'
  - url: 'https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab'
  - url: 'https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb'
  - url: 'https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66'
  - url: 'https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc'
tags:
  - cve.org
epss: 0.00724
epssPercentile: 0.53134
ingestedAt: '2026-10-16T17:24:46.877Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.

Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.

## Affected

- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < 7d56f5c868d92c9d504a34a3ea450bce481c7f63`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < 9f8076cc73dfa6b10155978c160587e986b22169`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < a040004846f1fbe687f6ec76d9ccc27b4ead42e4`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < 05b3e37433cf2eaf8867f1c16528aa347bb212ab`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < cb7bdae7fba404852ade34b0c1445fbaf3e54fbb`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < ef2ee18fec92088c7d8877baf7674e89389ccd66`
- `Linux >= 4949314c7283ea4f9ade182ca599583b89f7edd6 < fda6a1f3c3d7047b5ce5654487649c2daa738bfc`
- `Linux d2227f84ba0e97906153ac83db13213fb2e3938d`
- `Linux >= 3.2.9 < 3.3`
- `Linux 3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.