CVE-2026-97951
Received Received - Intake

iSCSI Target Write Command Abort Deadlock Fix

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands When a LUN_RESET aborts a WRITE command that is in the TRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and waits for the frontend to finish processing. If the initiator subsequently sends the remaining dataout PDUs, __iscsit_check_dataout_hdr() catches the payload, stops the dataout timer if the sequence is final and finally dumps the data. However, the iSCSI target doesn't trigger the completion process for these aborted commands. Because of this, the abort path hangs indefinitely in target_put_cmd_and_wait(), leading to a deadlocked target worker thread. Fix this by explicitly calling target_complete_cmd() when the final dataout PDU is received for an aborted WRITE command. target_complete_cmd() detects the CMD_T_ABORTED flag and cleanly routes the command into target_abort_work, allowing the abort completion to successfully unblock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97951
EUVD
EUVD-2026-86805

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a deadlock issue in the iSCSI target subsystem. When a WRITE command in the TRANSPORT_WRITE_PENDING state is aborted by a LUN_RESET, the target core sets a flag but fails to properly complete the command. If the initiator sends remaining data PDUs, the target processes them but does not trigger the completion, causing the abort path to hang indefinitely. This blocks the target worker thread.

Detection Guidance

This vulnerability is specific to the Linux kernel's iSCSI target implementation and may not have direct detection commands. Monitor for symptoms like hung worker threads or aborted WRITE_PENDING commands in system logs. Check for kernel messages related to iSCSI target hangs or deadlocks using dmesg or journalctl.

Impact Analysis

This vulnerability can cause system hangs or unresponsiveness in systems using the Linux kernel's iSCSI target functionality. If exploited, it may lead to denial-of-service conditions where the affected system becomes stuck, requiring a reboot to recover. It primarily affects servers or storage devices acting as iSCSI targets.

Mitigation Strategies

Apply the kernel patch that fixes this issue. Update to a version of the Linux kernel that includes the fix for the iSCSI target WRITE_PENDING hang. If immediate patching is not possible, consider disabling the iSCSI target service temporarily until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart