← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99206

28 October 2026

Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free.

Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.

Introduced

3.1 e48354ce078c079996f89d715dfa44814b4eba01

Fixed releases

6.18.59 9b07828b133b326cb4fb59f144ca37f8db535999

7.2.13 6caa2b3edb7da4f50a38e16561b75fcae21d4099

7.3 e15b81f602edbdee39c335546f25486a1747f3f0

View source announcement ↗