)]}'
{
  "commit": "8182b8864d9e39f8ec1bd6d96a4e6b2380412f26",
  "tree": "4d9ab7026aa3c956dcd4ad6da6cef3c0b3b65b64",
  "parents": [
    "3b507fe21a00fa1b523aaf7d01bc3ddbede53647"
  ],
  "author": {
    "name": "Maurizio Lombardi",
    "email": "mlombard@redhat.com",
    "time": "Mon Jan 12 17:53:51 2026 +0100"
  },
  "committer": {
    "name": "Cloud Image Release",
    "email": "cloud-image-release@prod.google.com",
    "time": "Mon Mar 02 16:34:46 2026 -0800"
  },
  "message": "scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\n[ Upstream commit 9411a89e9e7135cc459178fa77a3f1d6191ae903 ]\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u003econn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().\n\nBUG\u003db/485834718\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-23216 in the Linux kernel.\n\ncos-patch: security-moderate\nChange-Id: I8ad4b6f22f71e8f166399574f36d051baa45ee7b\nSigned-off-by: Maurizio Lombardi \u003cmlombard@redhat.com\u003e\nReported-by: Zhaojuan Guo \u003czguo@redhat.com\u003e\nReviewed-by: Mike Christie \u003cmichael.christie@oracle.com\u003e\nLink: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Angel Adetula \u003cangeladetula@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/135581\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/135667\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ee0cf2c74952a601a05431c50bdf2945ffe50bdd",
      "old_mode": 33188,
      "old_path": "drivers/target/iscsi/iscsi_target_util.c",
      "new_id": "b7fa8eed213bb3d1d0e36576c6666e4475e86a8b",
      "new_mode": 33188,
      "new_path": "drivers/target/iscsi/iscsi_target_util.c"
    }
  ]
}