---
id: CVE-2026-99206
title: 'scsi: target: iscsi: Fix race in discovery auth updates'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: target: iscsi: Fix race in discovery auth updates

  Separate configfs opens can concurrently update the discovery AuthMethod
  parameter. Both callers may free the s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e48354ce078c079996f89d715dfa44814b4eba01 <
    9b07828b133b326cb4fb59f144ca37f8db535999
  - >-
    Linux >= e48354ce078c079996f89d715dfa44814b4eba01 <
    6caa2b3edb7da4f50a38e16561b75fcae21d4099
  - >-
    Linux >= e48354ce078c079996f89d715dfa44814b4eba01 <
    e15b81f602edbdee39c335546f25486a1747f3f0
  - Linux 3.1
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:59.851Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99206'
references:
  - url: 'https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999'
  - url: 'https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099'
  - url: 'https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.361Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix race in discovery auth updates

Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.

Protect the lookup and replacement with the discovery TPG access lock,
as used by the other TPG configfs parameter updates.

## Affected

- `Linux >= e48354ce078c079996f89d715dfa44814b4eba01 < 9b07828b133b326cb4fb59f144ca37f8db535999`
- `Linux >= e48354ce078c079996f89d715dfa44814b4eba01 < 6caa2b3edb7da4f50a38e16561b75fcae21d4099`
- `Linux >= e48354ce078c079996f89d715dfa44814b4eba01 < e15b81f602edbdee39c335546f25486a1747f3f0`
- `Linux 3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.