)]}'
{
  "commit": "810772cc40b9bc07245d9d7059e7f2d697995adf",
  "tree": "346cfc8a5c3270b0ff69044f50471cefa317164f",
  "parents": [
    "cc0486b92c15b2ec152c44a87c2047ab15384149"
  ],
  "author": {
    "name": "Maurizio Lombardi",
    "email": "mlombard@redhat.com",
    "time": "Mon Jan 12 17:53:51 2026 +0100"
  },
  "committer": {
    "name": "Derek Taylor",
    "email": "ddtaylor@google.com",
    "time": "Fri Mar 06 22:19:38 2026 -0800"
  },
  "message": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\n[ Upstream commit 9411a89e9e7135cc459178fa77a3f1d6191ae903 ]\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u003econn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().\n\nBUG\u003db/485835209\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-23216 in the Linux kernel.\n\ncos-patch: security-moderate\nChange-Id: Ibd3cc60654493b6db77d8a4ff37312c96ed9598a\nSigned-off-by: Maurizio Lombardi \u003cmlombard@redhat.com\u003e\nReported-by: Zhaojuan Guo \u003czguo@redhat.com\u003e\nReviewed-by: Mike Christie \u003cmichael.christie@oracle.com\u003e\nLink: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/136081\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ee0cf2c74952a601a05431c50bdf2945ffe50bdd",
      "old_mode": 33188,
      "old_path": "drivers/target/iscsi/iscsi_target_util.c",
      "new_id": "b7fa8eed213bb3d1d0e36576c6666e4475e86a8b",
      "new_mode": 33188,
      "new_path": "drivers/target/iscsi/iscsi_target_util.c"
    }
  ]
}