Live › vulnerability › CVE-2026-99206
Go to dashboardConcurrent configfs writes to the iSCSI discovery AuthMethod parameter in the Linux kernel's SCSI target code can free the same value twice. The sources do not state what an attacker can do beyond crashing or corrupting kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only hosts that run the Linux kernel's iSCSI target (LIO) and let users or tools write discovery auth settings through configfs are relevant. Systems that are not iSCSI targets, or that do not export iSCSI, can skip it; the sources do not give further detail.
No product ranges from the sources yet.
uname -r and compare against the kernel versions listed in the NVD entrytargetcli ls or by looking for configfs entries under /sys/kernel/config/target/iscsiEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix race in discovery auth updates
Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free.
Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.
This page as .md · .json · in your agent: get_signal("CVE-2026-99206")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.