CVE-2026-64103
Received Received - Intake

Use-After-Free in Linux Kernel ISCI Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64103
EUVD
EUVD-2026-45788

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ISCI SCSI driver. It occurs during device removal when the completion tasklet is not properly stopped before teardown. The tasklet can still be scheduled by interrupt handlers even after the controller is stopped, leading to potential dereferencing of freed memory and access to invalid host structures.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI ISCI driver and involves a use-after-free issue during device removal. Detection requires checking kernel logs for related errors or kernel crashes during SCSI device removal or driver unloading. Monitor logs for tasklet-related warnings or crashes in the SCSI subsystem.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or privilege escalation if exploited. It specifically affects systems using the ISCI SCSI driver during device removal or driver unloading, potentially leading to memory corruption and unstable system behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's SCSI driver (isci) that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest kernel updates or patches that address this specific issue. Avoid unloading or removing SCSI devices while the system is under heavy I/O load. Monitor kernel logs for any signs of tasklet-related crashes or use-after-free errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart