---
id: "CVE-2026-99206"
kind: "vulnerability"
aliases: ["CVE-2026-99206"]
title: "Linux kernel: race in iSCSI discovery auth updates causes double-free"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iscsi-target", "linux-kernel", "self-hosted"]
not_affected_if: ["no-iscsi-target"]
published_at: "2026-10-28T11:17:41+00:00"
first_seen_at: "2026-10-28T11:32:37+00:00"
updated_at: "2026-10-28T11:33:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99206", "first_seen_at": "2026-10-28T11:32:37+00:00"}]
---

# Linux kernel: race in iSCSI discovery auth updates causes double-free

Concurrent configfs writes to the iSCSI discovery AuthMethod parameter in the Linux kernel's SCSI target code can free the same value twice. The sources do not state what an attacker can do beyond crashing or corrupting kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel versions listed in the NVD entry
- Check whether the iSCSI target (LIO) is in use with `targetcli ls` or by looking for configfs entries under `/sys/kernel/config/target/iscsi`

## Fix

- Install the kernel update from your distribution that includes the upstream fix for CVE-2026-99206 (version unknown from sources)
- Reboot into the patched kernel

## Timeline

- 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99206

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix race in discovery auth updates

Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.

Protect the lookup and replacement with the discovery TPG access lock,
as used by the other TPG configfs parameter updates.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_