UBUNTU-CVE-2026-98357: Use After Free
In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone() hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then runs isertcompletionput() -> isertputcmd(), which reads isertconn->conn and takes conn->cmdlock. Nothing orders that work item against teardown. isertwaitconn() queues isertreleasework, which frees isertconn, and iscsitcloseconnection() frees the iscsitconn right after it returns, so the queued work can run against freed memory. Count the deferred control PDU completions per connection and let isertwaitconn() wait for them before the release work is queued. ISTATESENDLOGOUTRSP is deliberately not counted: that branch runs iscsitlogoutposthandler(), which ends up waiting for conn->connwaitcomp, and that completion is only sent by iscsitcloseconnection() after it has called iscsitwaitconn(). Waiting for it here would deadlock. Its wait stays the existing isertwait4logout(). The splat below is from a kernel with tracing printk()s and an msleep(200) injected into isertdocontrolcomp() to widen the window: BUG: KASAN: slab-use-after-free in isertputcmd+0x53d/0x620 Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182 CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy) Tainted: [B]=BADPAGE Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: isertcompwq isertdocontrolcomp Call Trace: <TASK> dumpstacklvl+0x53/0x70 printreport+0xd0/0x630 ? pfxrawspinlockirqsave+0x10/0x10 ? rawspinunlockirqrestore+0x3e/0x70 ? isertputcmd+0x53d/0x620 kasanreport+0xce/0x100 ? isertputcmd+0x53d/0x620 isertputcmd+0x53d/0x620 ? isertcompletionput+0x305/0x330 ? isertdocontrolcomp+0x2ef/0x310 processonework+0x633/0x1030 ? assignwork+0x11d/0x370 workerthread+0x45b/0xd10 ? pfxworkerthread+0x10/0x10 ? pfxworkerthread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalcsigpending+0x15c/0x1e0 ? pfxkthread+0x10/0x10 retfromfork+0x36e/0x5a0 ? pfxretfromfork+0x10/0x10 ? switchto+0x572/0xdd0 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK> Allocated by task 48: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasankmalloc+0x8f/0xa0 kmalloccachenoprof+0x158/0x370 isertcmahandler+0x1e3/0x2ae0 cmacmeventhandler+0x3e/0x240 cmaibreqhandler+0x17d9/0x4490 cmprocesswork+0x41/0x330 cmworkhandler+0x5727/0xc160 processonework+0x633/0x1030 workerthread+0x45b/0xd10 kthread+0x2c6/0x3b0 retfromfork+0x36e/0x5a0 retfromforkasm+0x1a/0x30 Freed by task 184: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x43/0x70 kfree+0x121/0x380 iscsitcloseconnection+0x7cf/0x1e60 iscsittakeactionforconnectionexit+0x1b6/0x360 iscsitargettxthread+0x472/0x690 kthread+0x2c6/0x3b0 retfromfork+0x36e/0x5a0 retfromforkasm+0x1a/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel IB/isert connection teardown path, count deferred control PDU completions for each connection and make isert_wait_conn() wait for those completions before queuing isert_release_work; do not count ISTATE_SEND_LOGOUTRSP, because its path waits for conn->conn_wait_comp and counting it would deadlock.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the listed Ubuntu kernel packages are relevant when they use iSER connections. The race occurs during connection teardown while deferred control PDU completion work remains queued.
What does an attacker need to exploit it?
The vulnerability is reachable over the network and does not require privileges or user interaction. Exploitation has high attack complexity, meaning an attacker must successfully trigger the timing-dependent race between deferred completion handling and connection teardown.
What is the impact if the race is triggered?
Deferred work can access an iSER connection and associated iSCSI target connection after they have been freed, resulting in a use-after-free condition. The reported severity indicates potential impact to confidentiality, integrity, and availability.