CVE-2026-97951 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
An attacker can cause a denial of service by aborting iSCSI write commands, leading to a kernel deadlock in the target worker thread.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97951?
CVE-2026-97951 is a denial of service vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
When a LUN_RESET aborts a WRITE command that is in the TRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and waits for the frontend to finish processing.
If the initiator subsequently sends the remaining dataout PDUs, __iscsit_check_dataout_hdr() catches the payload, stops the dataout timer if the sequence is final and finally dumps the data. However, the iSCSI target doesn't trigger the completion process for these aborted commands. Because of this, the abort path hangs indefinitely in target_put_cmd_and_wait(), leading to a deadlocked target worker thread.
Fix this by explicitly calling target_complete_cmd() when the final dataout PDU is received for an aborted WRITE command. target_complete_cmd() detects the CMD_T_ABORTED flag and cleanly routes the command into target_abort_work, allowing the abort completion to successfully unblock.
Which versions are affected by CVE-2026-97951?
How do I fix CVE-2026-97951?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97951 being exploited?
There is no known exploitation of CVE-2026-97951 in the wild and no public exploit code.
Sources
Also known as AZL-110479, BELL-CVE-2026-97951, DEBIAN-CVE-2026-97951, GHSA-gmcj-g64q-4863, UBUNTU-CVE-2026-97951.