CVE-2026-99206scsi: target: iscsi: Fix race in discovery auth updates
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.
Timeline
ID reserved
By Linux
- 33 days later
· 33 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 128dfa7a9b4b3c956e8ac04a169a7ba04960cd75
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 35f3eb8ba914cbe079faf8712101b94ce6b2d821
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 3b206898acaf40f87cf59e97e511a6b60aad9d5e
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 57b6ebcc83afb5338c561ff97ca85dc954a89136
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 083eea404d162c324456cf4ff9912fe8701d936b
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 9b07828b133b326cb4fb59f144ca37f8db535999
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < 6caa2b3edb7da4f50a38e16561b75fcae21d4099
- affected e48354ce078c079996f89d715dfa44814b4eba01 – < e15b81f602edbdee39c335546f25486a1747f3f0
- affected 3.1
- unaffected < 3.1
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/128dfa7a9b4b3c956e8ac04a169a7ba04960cd75 (opens in a new tab)
- https://git.kernel.org/stable/c/35f3eb8ba914cbe079faf8712101b94ce6b2d821 (opens in a new tab)
- https://git.kernel.org/stable/c/3b206898acaf40f87cf59e97e511a6b60aad9d5e (opens in a new tab)
- https://git.kernel.org/stable/c/57b6ebcc83afb5338c561ff97ca85dc954a89136 (opens in a new tab)
- https://git.kernel.org/stable/c/083eea404d162c324456cf4ff9912fe8701d936b (opens in a new tab)
- https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999 (opens in a new tab)
- https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099 (opens in a new tab)
- https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-111958 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99206)Record last updated .