Executive brief
A vulnerability in the Linux kernel's SCSI target subsystem could allow a local user to cause a system hang or crash. The issue occurs when the system incorrectly attempts to lock a resource it already controls during certain configuration changes. This results in a 'deadlock' or recursive locking state, which impacts the availability of the server and can disrupt storage operations.
Technical details
A recursive locking issue exists in the Linux kernel SCSI target subsystem within the `__configfs_open_file()` function. When `target_core_item_dbroot_store()` is called via `flush_write_buffer`, it attempts to validate a new file path using `filp_open()`. If the path provided points back to the same configfs file currently being operated on, the kernel attempts to acquire the `frag_sem` semaphore while already holding it. This uncontrolled recursion leads to a deadlock. The fix replaces the use of `filp_open()` with `kern_path()` to validate the directory path without triggering the filesystem-specific open routine that manages the semaphore.
Affected products
- Linux Linux Kernel 4.9.201 to 4.10, 4.14.154 to 4.15, 4.19.84 to 4.20, 5.3.1 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-02-16: other: Patch authored
- 2026-03-25: advisory: CVE published
- 2026-03-25: patched: Fixes merged into various stable branches
References
- https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582
- https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b
- https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3
- https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a
- https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438
- https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea