All vulnerabilities
CVE-2026-97951

Linux: scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in19315262991dc983cc5c5c2ed24ff768abbf9339Also 9c777f8e0cb0486fdf16db8ffea32e562a31e85b, 638cf7c0cf64d5bb5704c3a78b54ae6602f69a32 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 19315262991dc983cc5c5c2ed24ff768abbf9339LinuxCVE List
  • 9c777f8e0cb0486fdf16db8ffea32e562a31e85bLinuxCVE List
  • 638cf7c0cf64d5bb5704c3a78b54ae6602f69a32LinuxCVE List
  • 37f7f54d06c6100511979d6e9c1222b404e3f006LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

When a LUN_RESET aborts a WRITE command that is in the TRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and waits for the frontend to finish processing.

If the initiator subsequently sends the remaining dataout PDUs, __iscsit_check_dataout_hdr() catches the payload, stops the dataout timer if the sequence is final and finally dumps the data. However, the iSCSI target doesn't trigger the completion process for these aborted commands. Because of this, the abort path hangs indefinitely in target_put_cmd_and_wait(), leading to a deadlocked target worker thread.

Fix this by explicitly calling target_complete_cmd() when the final dataout PDU is received for an aborted WRITE command. target_complete_cmd() detects the CMD_T_ABORTED flag and cleanly routes the command into target_abort_work, allowing the abort completion to successfully unblock.

Text from CVE List

Affected versions 18

  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before b070c8b4b237d55bdac13da3c5a994491177b312CVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before 19315262991dc983cc5c5c2ed24ff768abbf9339CVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before f806f54ae3de780b8f4139baefc95b81c599cf9fCVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before 9c777f8e0cb0486fdf16db8ffea32e562a31e85bCVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before 638cf7c0cf64d5bb5704c3a78b54ae6602f69a32CVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before f6f6351e98c77c27b51763ef52deb2efe4b46ac7CVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before 37f7f54d06c6100511979d6e9c1222b404e3f006CVE List
  • Linuxaffected: 2c9fa49e100f962af988f1c0529231bf14905cda before d5869dae5080e976d4b03cc33eb7ceb527f242bfCVE List
  • Linuxaffected: 5.0CVE List
  • Linuxunaffected: all versions before 5.0CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8