Strix
73.2K

CVE-2026-99206

UnknownEPSS 0.16%

Last modified

CVE-2026-99206 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.

Metrics

EPSS Probability
0.16%

5.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e48354ce078c079996f89d715dfa44814b4eba01, < 128dfa7a9b4b3c956e8ac04a169a7ba04960cd75; >= e48354ce078c079996f89d715dfa44814b4eba01, < 35f3eb8ba914cbe079faf8712101b94ce6b2d821; >= e48354ce078c079996f89d715dfa44814b4eba01, < 3b206898acaf40f87cf59e97e511a6b60aad9d5e; >= e48354ce078c079996f89d715dfa44814b4eba01, < 57b6ebcc83afb5338c561ff97ca85dc954a89136; >= e48354ce078c079996f89d715dfa44814b4eba01, < 083eea404d162c324456cf4ff9912fe8701d936b; >= e48354ce078c079996f89d715dfa44814b4eba01, < 9b07828b133b326cb4fb59f144ca37f8db535999; >= e48354ce078c079996f89d715dfa44814b4eba01, < 6caa2b3edb7da4f50a38e16561b75fcae21d4099; >= e48354ce078c079996f89d715dfa44814b4eba01, < e15b81f602edbdee39c335546f25486a1747f3f0
LinuxLinux3.1

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99206?
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates.
How severe is CVE-2026-99206?
Severity scoring for CVE-2026-99206 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99206?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99206?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST