CVE-2026-99206

What it actually does

Race condition allows concurrent configfs updates to the iSCSI discovery AuthMethod parameter, resulting in iscsi_update_param_value freeing the same memory twice and triggering a double-free.

Why it matters to the business

Systems exposing iSCSI targets can experience kernel crashes or memory corruption that interrupt storage services and require emergency restarts or patching.

How an attack unfolds

An attacker with local access to the configfs interface opens multiple concurrent sessions that modify the discovery authentication parameter; the unprotected lookup and replacement path in iscsi_update_param_value causes both threads to free the same pointer.

How to fix it

Apply the upstream fix that serializes discovery TPG parameter updates under the existing access lock; rebuild and deploy the patched kernel to all affected systems.

How to confirm the fix worked

Confirm the presence of the locking change around the discovery AuthMethod update path in the iscsi target configfs code; recompile and boot the fixed kernel, then exercise concurrent configfs writes to verify no double-free occurs.

Typical attack path

1. Obtain local shell or process with write access to the iSCSI target configfs tree
2. Trigger simultaneous updates to the discovery AuthMethod parameter from separate threads or processes
3. Cause iscsi_update_param_value to execute the double-free path
4. Trigger kernel panic or attempt to leverage freed memory for further exploitation

How to detect it

Search kernel logs and crash dumps for double-free or use-after-free reports involving iscsi_update_param_value or discovery TPG parameter handling; review audit logs for rapid successive writes to the discovery AuthMethod configfs attribute.

What your security team should do

• Prioritize kernel updates on all hosts running iSCSI target mode within the next maintenance window
• Restrict configfs access to only the processes that legitimately manage iSCSI targets
• Monitor kernel logs for double-free or slab corruption messages referencing iscsi_update_param_value