Race Condition in Linux Kernel's iSCSI Discovery Authentication Update

CVE-2026-99206

What is CVE-2026-99206?

A race condition vulnerability in the Linux kernel pertains to the iSCSI target discovery authentication updates. The issue arises when separate configfs opens concurrently update the discovery AuthMethod parameter, leading to a potential double-free situation when both callers attempt to free the same value in the iscsi_update_param_value() function. To mitigate this issue, access locks for the discovery Target Port Group (TPG) have been introduced, ensuring that parameter updates are synchronized effectively, thus preventing exploitation.

References