CVE-2026-23292

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix recursive locking in __configfs_open_file()

In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace:

down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter

target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows:

db_root: not a directory: /sys/kernel/config/target/dbroot

indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking.

Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582
• https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b
• https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3
• https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a
• https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438
• https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea