CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection
IB/isert: wait for deferred control PDU completions before releasing the connection
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel iSER target path are exposed when deferred control PDU completion work can remain queued while an iSER connection is being torn down. The affected completion states are task-management response, reject, and text response handling.
What condition is required to trigger the issue?
A deferred control PDU completion must execute after connection teardown has released the associated iSER and iSCSI connection objects. The deferred worker then accesses the freed connection and attempts to take its command lock, resulting in a use-after-free condition.
What does the fix change?
The fix counts deferred control PDU completions for each connection and makes connection teardown wait for those completions before scheduling release work. Logout response handling is intentionally excluded because waiting for it at that point would deadlock.