CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.

Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.

The Linux kernel CVE team has assigned CVE-2026-72083 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 5.10.261 with commit 7d56f5c868d92c9d504a34a3ea450bce481c7f63
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 5.15.212 with commit 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 6.1.178 with commit 9f8076cc73dfa6b10155978c160587e986b22169
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 6.6.145 with commit a040004846f1fbe687f6ec76d9ccc27b4ead42e4
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 6.12.97 with commit 05b3e37433cf2eaf8867f1c16528aa347bb212ab
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 6.18.40 with commit cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 7.1.5 with commit ef2ee18fec92088c7d8877baf7674e89389ccd66
	Issue introduced in 3.3 with commit 4949314c7283ea4f9ade182ca599583b89f7edd6 and fixed in 7.2-rc4 with commit fda6a1f3c3d7047b5ce5654487649c2daa738bfc
	Issue introduced in 3.2.9 with commit d2227f84ba0e97906153ac83db13213fb2e3938d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72083
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/target/target_core_pr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63
	https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
	https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169
	https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4
	https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab
	https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
	https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66
	https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc