External risk intelligence

Linux Kernel SCSI Target iSCSI Use-After-Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72083

This vulnerability affects Linux kernel SCSI target iSCSI processing. While iSCSI is a network protocol, it is typically restricted to dedicated storage area networks or internal data center segments rather than public internet exposure. Access requires specific network configuration and is protected by internal infrastructure controls, making exposure to the public internet uncommon.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in the Linux kernel's handling of storage-related commands, specifically within the iSCSI protocol. The issue could allow for unauthorized access or manipulation of data due to a memory management error. The main concern is confirming relevance and exposure.

Memory error in Linux kernel storage handling.
Affects systems using iSCSI for data storage.
Confirm relevance and exposure for risk assessment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted iSCSI network traffic to a Linux system. The system's SCSI target functionality, specifically its iSCSI implementation, processes this traffic. A flaw in how the kernel handles certain iSCSI commands, particularly when large parameter lists are involved, can lead to a use-after-free condition, allowing an attacker to potentially read or modify sensitive kernel memory.

Requires network access to the system.
Triggered by malformed iSCSI registration commands.
Could lead to memory corruption and system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker to leverage a use-after-free condition in the Linux kernel's SCSI target iSCSI implementation. This could lead to sensitive information disclosure, modification of data, or denial of service by reading from or writing to unmapped memory regions.

Kernel memory could be affected.
Malicious iSCSI REGISTER AND MOVE commands.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's SCSI target subsystem, specifically impacting iSCSI operations. Infrastructure or platform teams managing Linux servers are likely responsible for this component. The first practical step is to inventory systems running the Linux kernel, confirm which are configured for iSCSI target functionality, and assess their network exposure. Subsequently, engaging the accountable system owner to prioritize remediation based on potential business impact and accessibility is crucial.

Infrastructure or platform teams own this.
Verify Linux kernel iSCSI target systems.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SCSI target component?

The SCSI target component in the Linux kernel allows a server to act as a storage provider. It enables other computers to connect over a network and access storage resources—like disks or tapes—as if they were directly attached. It is commonly used in enterprise data centers for storage area networks (SANs) where Linux servers provide high-performance block storage services to other systems.

How does this CVE-2026-72083 memory error happen?

This vulnerability is a Use-After-Free flaw. The kernel maps a memory buffer to process incoming iSCSI commands but prematurely unmaps it while still needing the data. When the command involves a large parameter list, the kernel destroys the memory mapping. If the system then tries to read that data, it accesses unallocated or reassigned memory, which can lead to system instability or unauthorized access to kernel memory.

What triggers this vulnerability?

The bug is triggered by specific iSCSI 'REGISTER AND MOVE' commands that include an unusually large parameter list, specifically exceeding one page of memory (4096 bytes). Commands with smaller, standard-sized parameter lists do not trigger the flaw, nor do commands that do not involve the affected iSCSI registration logic.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability is unlikely to be exposed to the public internet. Because the issue exists within the iSCSI storage protocol, it typically resides on internal data center segments or dedicated storage networks. Unless you have specifically configured your storage targets to be reachable from untrusted external networks, the risk of remote exploitation is generally mitigated by your internal infrastructure controls.

How should I respond to CVE-2026-72083?

First, identify which of your servers run the Linux kernel with SCSI target functionality enabled for iSCSI. Once you have an inventory of these specific systems, coordinate with your infrastructure or platform team to review their network placement and security controls. Finally, prioritize these systems for kernel updates provided by your distribution vendor to resolve the memory management defect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.