{"id":"CVE-2026-99206","kind":"vulnerability","aliases":["CVE-2026-99206"],"related":[],"title":"Linux kernel: race in iSCSI discovery auth updates causes double-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates.","summary":"Concurrent configfs writes to the iSCSI discovery AuthMethod parameter in the Linux kernel's SCSI target code can free the same value twice. The sources do not state what an attacker can do beyond crashing or corrupting kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iscsi-target","linux-kernel","self-hosted"],"not_affected_if":["no-iscsi-target"],"how_to_check":"- Run `uname -r` and compare against the kernel versions listed in the NVD entry\n- Check whether the iSCSI target (LIO) is in use with `targetcli ls` or by looking for configfs entries under `/sys/kernel/config/target/iscsi`","fix":"- Install the kernel update from your distribution that includes the upstream fix for CVE-2026-99206 (version unknown from sources)\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:56+00:00","updated_at":"2026-10-28T11:33:56+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:33:56Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel update from your distribution that includes the upstream fix for CVE-2026-99206 (version unknown from sources)\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel: race in iSCSI discovery auth updates causes double-free","impact":"medium","summary":"Concurrent configfs writes to the iSCSI discovery AuthMethod parameter in the Linux kernel's SCSI target code can free the same value twice. The sources do not state what an attacker can do beyond crashing or corrupting kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","iscsi-target","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory corruption from a double-free; full impact unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, required privileges to reach configfs, and whether the double-free is reachable beyond root.","how_to_check":"- Run `uname -r` and compare against the kernel versions listed in the NVD entry\n- Check whether the iSCSI target (LIO) is in use with `targetcli ls` or by looking for configfs entries under `/sys/kernel/config/target/iscsi`","needs_analyst":true,"not_affected_if":["no-iscsi-target"],"who_is_affected":"Only hosts that run the Linux kernel's iSCSI target (LIO) and let users or tools write discovery auth settings through configfs are relevant. Systems that are not iSCSI targets, or that do not export iSCSI, can skip it; the sources do not give further detail.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3364,"output_tokens":606,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99206':15A,18A 'access':123C 'attack':59B 'auth':7A,85C 'authmethod':36B,95C 'beyond':62B 'caller':98C 'caus':9A,109C 'code':45B 'concurr':29B,91C 'configf':30B,88C,131C 'corrupt':65B 'crash':63B 'cve':13A,16A 'discoveri':6A,35B,84C,94C,121C 'doubl':11A,112C 'double-fre':10A,111C 'fix':81C 'follow':73C 'free':12A,47B,100C,113C 'host':28B 'infrastructur':19B 'iscsi':5A,21B,34B,80C,105C 'iscsi-target':20B 'kernel':2A,25B,41B,66B,71C 'linux':1A,24B,40B,70C 'linux-kernel':23B 'lock':124C 'lookup':116C 'may':99C 'memori':67B 'open':89C 'param':107C 'paramet':37B,96C,132C 'protect':114C 'race':3A,82C 'replac':118C 'resolv':77C 'scsi':43B,78C 'self':27B 'self-host':26B 'separ':87C 'sourc':53B 'state':56B 'target':22B,44B,79C 'tpg':122C,130C 'twice':51B 'updat':8A,86C,92C,106C,133C 'use':126C 'valu':50B,103C,108C 'vulner':74C 'write':31B","nicknames":[],"mitigations":[],"who_affected":"Only hosts that run the Linux kernel's iSCSI target (LIO) and let users or tools write discovery auth settings through configfs are relevant. Systems that are not iSCSI targets, or that do not export iSCSI, can skip it; the sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99206","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}