Executive brief
The Linux kernel contains a race condition in its SCSI target implementation that causes incorrect handling of multiple simultaneous LUN_RESET commands from different initiators. An attacker with network access to a system running affected kernel versions can trigger incomplete command cleanup, causing the target to send invalid task statuses and potential data corruption or service disruption on storage systems.
Technical details
This is a race condition vulnerability in the Linux kernel's SCSI target layer affecting LUN_RESET (Logical Unit Reset) command handling. The bug occurs when multiple initiators issue LUN_RESET commands concurrently—session1's LUN_RESET moves commands to its local drain list before session2's LUN_RESET executes, causing session2's reset to appear successful while commands remain uncleared. The vulnerability stems from commit 51ec502a3266 removing LUN_RESET entries from the list before processing, preventing subsequent resets from seeing earlier ones. The attack is network-reachable and requires no authentication beyond standard SCSI protocol access. An attacker can trigger race conditions leading to invalid task statuses being returned, causing initiators to incorrectly handle I/O completion and potentially leading to data inconsistency or service denial. The fix reverts the problematic commit and serializes LUN_RESET, Preempt, and Abort command execution while preventing deadlock conditions in core_tmr_drain_tmr_list.
Affected products
- Linux Linux kernel
Timeline
- 2025-10-04: disclosed