CVE-2026-72083

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

corescsi3emulateproregisterandmove() maps the PERSISTENT RESERVE OUT

parameter list with transportkmapdata_sg() and parses the destination

TransportID with targetparseprouttransport_id(). For an iSCSI

TransportID (FORMAT CODE 01b), iscsiparseprouttransport_id() returns

the ISID in iport_ptr as a raw pointer into that mapped buffer.

The function then unmaps the buffer with transportkunmapdata_sg() before

dereferencing iportptr in strcmp(), corescsi3locatepr_reg() and

corescsi3alloc_registration(). When the parameter list spans more than

one page (PARAMETER LIST LENGTH > 4096), transportkmapdata_sg() uses

vmap() and transportkunmapdata_sg() does vunmap(), so the kernel virtual

address backing iport_ptr is torn down and every subsequent dereference is

a use-after-free read of the unmapped region.

Keep the parameter list mapped until iport_ptr is no longer needed: drop

the early transportkunmapdata_sg() and unmap once on the success path,

right before returning. The error paths already unmap through the existing

"if (buf) transportkunmapdata_sg(cmd)" at the out: label, which now runs

on every post-map error exit because buf is no longer cleared early. Only

reads of the mapping happen while spinlocks are held; the map and unmap

calls remain outside any lock. The sibling caller

corescsi3decodespeci_port() already uses the buffer before unmapping it

and is left unchanged.