CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

corescsi3emulateproregisterandmove() maps the PERSISTENT RESERVE OUT parameter list with transportkmapdatasg() and parses the destination TransportID with targetparseprouttransportid(). For an iSCSI TransportID (FORMAT CODE 01b), iscsiparseprouttransportid() returns the ISID in iportptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transportkunmapdatasg() before dereferencing iportptr in strcmp(), corescsi3locateprreg() and corescsi3allocregistration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transportkmapdatasg() uses vmap() and transportkunmapdatasg() does vunmap(), so the kernel virtual address backing iportptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region.

Keep the parameter list mapped until iportptr is no longer needed: drop the early transportkunmapdatasg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transportkunmapdatasg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller corescsi3decodespeciport() already uses the buffer before unmapping it and is left unchanged.