CVE-2026-72083

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SCSI target core during the REGISTER AND MOVE process. The function core scsi3 emulate pro register and move() maps the PERSISTENT RESERVE OUT parameter list using transport kmap data sg() and parses the destination TransportID via target parse pr out transport id(). For iSCSI TransportIDs, the ISID is returned in iport ptr as a raw pointer to the mapped buffer.

The issue occurs when the buffer is unmapped using transport kunmap data sg() before iport ptr is dereferenced in strcmp(), core scsi3 locate pr reg(), and core scsi3 alloc registration(). If the parameter list exceeds one page (greater than 4096 bytes), the kernel virtual address is torn down, leading to a use-after-free read of the unmapped region.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.