1. Home
  2. Vulnerabilities
  3. CVE-2026-72083
9.8
CRITICAL CVSS 3.1
CVE-2026-72083
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.

Details
INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72083 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix use-after-free by keeping the parameter list mapped until no longer needed.
  • Unmap the buffer after dereferencing the pointer.
  • Remove early unmapping of the buffer.
  • Keep the parameter list mapped until no longer needed.
  • Unmap only on the success path before returning.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72083.

URL Resource
https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab
https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63
https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169
https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4
https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66
https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72083 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72083 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72083 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72083 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '7d56f5c868d92c9d504a34a3ea450bce481c7f63', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '59a2a5a37dc49a641ad6bc64aee34e5a61025ffd', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '9f8076cc73dfa6b10155978c160587e986b22169', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'a040004846f1fbe687f6ec76d9ccc27b4ead42e4', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '05b3e37433cf2eaf8867f1c16528aa347bb212ab', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'cb7bdae7fba404852ade34b0c1445fbaf3e54fbb', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'ef2ee18fec92088c7d8877baf7674e89389ccd66', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'fda6a1f3c3d7047b5ce5654487649c2daa738bfc', 'versionType': 'git'}, {'status': 'affected', 'version': 'd2227f84ba0e97906153ac83db13213fb2e3938d', 'versionType': 'git'}, {'status': 'affected', 'version': '3.2.9', 'lessThan': '3.3', 'versionType': 'semver'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '7d56f5c868d92c9d504a34a3ea450bce481c7f63', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '59a2a5a37dc49a641ad6bc64aee34e5a61025ffd', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '9f8076cc73dfa6b10155978c160587e986b22169', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'a040004846f1fbe687f6ec76d9ccc27b4ead42e4', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '05b3e37433cf2eaf8867f1c16528aa347bb212ab', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'cb7bdae7fba404852ade34b0c1445fbaf3e54fbb', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'ef2ee18fec92088c7d8877baf7674e89389ccd66', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'fda6a1f3c3d7047b5ce5654487649c2daa738bfc', 'versionType': 'git'}, {'status': 'affected', 'version': 'd2227f84ba0e97906153ac83db13213fb2e3938d', 'versionType': 'git'}, {'status': 'affected', 'version': '3.2.9', 'lessThan': '3.3', 'versionType': 'semver'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '7d56f5c868d92c9d504a34a3ea450bce481c7f63', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '59a2a5a37dc49a641ad6bc64aee34e5a61025ffd', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '9f8076cc73dfa6b10155978c160587e986b22169', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'a040004846f1fbe687f6ec76d9ccc27b4ead42e4', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': '05b3e37433cf2eaf8867f1c16528aa347bb212ab', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'cb7bdae7fba404852ade34b0c1445fbaf3e54fbb', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'ef2ee18fec92088c7d8877baf7674e89389ccd66', 'versionType': 'git'}, {'status': 'affected', 'version': '4949314c7283ea4f9ade182ca599583b89f7edd6', 'lessThan': 'fda6a1f3c3d7047b5ce5654487649c2daa738bfc', 'versionType': 'git'}, {'status': 'affected', 'version': 'd2227f84ba0e97906153ac83db13213fb2e3938d', 'versionType': 'git'}, {'status': 'affected', 'version': '3.2.9', 'lessThan': '3.3', 'versionType': 'semver'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/target/target_core_pr.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.
    Added Reference https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab
    Added Reference https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd
    Added Reference https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63
    Added Reference https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169
    Added Reference https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4
    Added Reference https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb
    Added Reference https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66
    Added Reference https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact