CVE-2026-64103

A flaw was found in the Linux kernel's ISCI (Intel(R) C600 Series Chipset Storage Control Unit) SCSI driver. This vulnerability occurs during device removal, where a timing issue can allow the system to attempt to use memory that has already been released. This 'use-after-free' condition could be exploited by a local attacker, potentially leading to a system crash or, in some scenarios, unauthorized access to system resources.

A use-after-free can occur in the ISCI SCSI driver removal path because completion_tasklet may remain queued while the host object is being torn down. The tasklet is scheduled from MSI-X and legacy interrupt handlers, and killing it before the interrupt source is quiesced is not sufficient because the handler can requeue it. After device remove or driver unload, a stale tasklet callback may dereference the freed ihost object and touch ihost smu_registers, leading at least to a kernel crash and potentially to memory corruption. For the CVSS the PR:L is used in the paranoid score because a reduced capability administrator, service account, or delegated device management context may be able to trigger driver removal or reset without full host control. The issue is local and not network reachable. Impact is at least denial of service, and because the primitive is a UAF in an asynchronous teardown path it should be reviewed for possible privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.