{"advisories":[{"id":"USN-8575-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-1"},{"id":"USN-8576-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-1"},{"id":"USN-8593-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8593-1"},{"id":"USN-8575-2","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-2"},{"id":"USN-8576-2","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-2"},{"id":"USN-8575-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-3"},{"id":"USN-8603-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8603-1"},{"id":"USN-8610-1","source":"usn","title":"Linux kernel (Azure CVM) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8610-1"},{"id":"USN-8618-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8618-1"},{"id":"USN-8620-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-1"},{"id":"USN-8620-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-2"},{"id":"USN-8620-3","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-3"},{"id":"USN-8620-4","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-4"},{"id":"USN-8663-1","source":"usn","title":"Linux kernel (NVIDIA) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8663-1"},{"id":"USN-8664-1","source":"usn","title":"Linux kernel (NVIDIA BaseOS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8664-1"},{"id":"USN-8668-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-1"},{"id":"USN-8728-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-1"},{"id":"USN-8729-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-1"},{"id":"USN-8761-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-1"},{"id":"USN-8729-2","source":"usn","title":"Linux kernel (Raspberry Pi Real-time) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-2"},{"id":"USN-8761-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-2"},{"id":"USN-8781-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8781-1"},{"id":"USN-8668-2","source":"usn","title":"Linux kernel (Raspberry Pi) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-2"},{"id":"USN-8729-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-3"},{"id":"USN-8802-1","source":"usn","title":"Linux kernel (Oracle) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8802-1"},{"id":"USN-8728-2","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-2"},{"id":"USN-8729-4","source":"usn","title":"Linux kernel (Low Latency) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-4"},{"id":"USN-8729-5","source":"usn","title":"Linux kernel (AWS FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-5"}],"cve":"CVE-2026-64103","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,1412995e10c74644b47f242aea6e4f3d4180e806)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,a83d3e4daba40d49324cec1c51ed261e1ea48cf1)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,ab2266601a875982f2d2033f41e070a6d5e615e2)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,309c6058622d080fe8c2fab87c30da82d834d989)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,cb9e72c50e6c81a5903f27e0b397ce8525d7539b)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,b9ff8631006233ba246828ac70409d2cb2da38d3)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,b52a8d52c3125ec9a93106ed816582368de34426)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,1412995e10c74644b47f242aea6e4f3d4180e806)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,a83d3e4daba40d49324cec1c51ed261e1ea48cf1)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,ab2266601a875982f2d2033f41e070a6d5e615e2)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,309c6058622d080fe8c2fab87c30da82d834d989)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,cb9e72c50e6c81a5903f27e0b397ce8525d7539b)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,b9ff8631006233ba246828ac70409d2cb2da38d3)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[6f231dda68080759f1aed3769896e94c73099f0f,b52a8d52c3125ec9a93106ed816582368de34426)"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"},{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.0,*]"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[0,3.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.10.258,5.11.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.15.209,5.16.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.1.175,6.2.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.6.142,6.7.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.12.92,6.13.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.18.34,6.19.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.0.11,7.1.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.1,*]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.0,*]"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[0,3.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.10.258,5.11.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.1,*]"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.1.175,6.2.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.6.142,6.7.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.12.92,6.13.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.18.34,6.19.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.0.11,7.1.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.15.209,5.16.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[2.1.0,2.2.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[0,1)"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"}],"created":"2026-07-21T18:15:10.269617+00:00","updated":"2026-08-13T12:45:03.415121+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"]},"epss":{"score":0.00171},"mitre":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"created":"2026-07-19T15:40:07.372000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost->smu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/64xxx/CVE-2026-64103.json","references":["https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806","https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989","https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c","https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1","https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2","https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426","https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3","https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b"],"title":"scsi: isci: Fix use-after-free in device removal path","updated":"2026-07-19T15:40:07.372000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"created":"2026-07-19T16:17:51.533000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost->smu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-64103.json","references":["https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806","https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989","https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c","https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1","https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2","https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426","https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3","https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b"],"title":null,"updated":"2026-08-12T15:49:19.403000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":["CWE-416"]},"opencve":{"changes":[{"created":"2026-07-19T16:15:00+00:00","data":[{"details":{"new":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost->smu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().","old":null},"type":"description"},{"details":{"new":"scsi: isci: Fix use-after-free in device removal path","old":null},"type":"title"},{"details":["linux","linux$PRODUCT$linux_kernel"],"type":"first_time"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["linux","linux$PRODUCT$linux_kernel"],"removed":[]},"type":"vendors"},{"details":{"added":["https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806","https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989","https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c","https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1","https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2","https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426","https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3","https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b"],"removed":[]},"type":"references"}],"id":"96adeecf-5e59-4e68-a2b4-115f0603ae60"},{"created":"2026-07-21T12:15:00+00:00","data":[{"details":{"added":["CWE-825"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64103","https://www.cve.org/CVERecord?id=CVE-2026-64103"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"1ba0340d-1fc6-43b8-a2e3-5e0140182a45"},{"created":"2026-08-12T16:00:00+00:00","data":[{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":{},"removed":{},"updated":{"cvssV3_1":{"new":{"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"old":{"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}}},"type":"metrics"}],"id":"297b5557-5c73-4e6d-8aa2-197dec3031a0"}],"cpes":{"data":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-07-19T00:00:00+00:00","provider":"redhat"},"description":{"data":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost->smu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00171},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806","https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989","https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c","https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1","https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2","https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426","https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3","https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b","https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64103","https://www.cve.org/CVERecord?id=CVE-2026-64103"],"providers":["mitre","nvd","redhat"]},"title":{"data":"scsi: isci: Fix use-after-free in device removal path","provider":"mitre"},"updated":{"data":"2026-08-12T15:49:19.403000+00:00","provider":"nvd"},"vendors":{"data":["linux","linux$PRODUCT$linux_kernel"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-416","CWE-825"],"providers":["nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-07-19T00:00:00+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\nscsi: isci: Fix use-after-free in device removal path\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost->smu_registers after the\nhost lifetime ends.\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-64103.json","references":["https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64103-24fe@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64103","https://www.cve.org/CVERecord?id=CVE-2026-64103"],"title":"kernel: scsi: isci: Fix use-after-free in device removal path","updated":"2026-07-19T00:00:00+00:00","vendors":[],"weaknesses":["CWE-825"]}}