CyberSecBulletin
CVE-2026-72083NVD status: Received

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-72083 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 7d56f5c868d92c9d504a34a3ea450bce481c7f63, 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd, 9f8076cc73dfa6b10155978c160587e986b22169 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.72% chance of exploitation within 30 days, higher than 55% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 7d56f5c868d92c9d504a34a3ea450bce481c7f63 or 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd or 9f8076cc73dfa6b10155978c160587e986b22169 or a040004846f1fbe687f6ec76d9ccc27b4ead42e4, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, 7d56f5c868d92c9d504a34a3ea450bce481c7f63; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, 9f8076cc73dfa6b10155978c160587e986b22169; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, a040004846f1fbe687f6ec76d9ccc27b4ead42e4; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, 05b3e37433cf2eaf8867f1c16528aa347bb212ab; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, cb7bdae7fba404852ade34b0c1445fbaf3e54fbb; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, ef2ee18fec92088c7d8877baf7674e89389ccd66; 4949314c7283ea4f9ade182ca599583b89f7edd6 up to, but not including, fda6a1f3c3d7047b5ce5654487649c2daa738bfc; and 3 more ranges7d56f5c868d92c9d504a34a3ea450bce481c7f63, 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd, 9f8076cc73dfa6b10155978c160587e986b22169, a040004846f1fbe687f6ec76d9ccc27b4ead42e4, 05b3e37433cf2eaf8867f1c16528aa347bb212ab, cb7bdae7fba404852ade34b0c1445fbaf3e54fbb

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.