🛡️ CVE-2026-23292 — kernel

scsi: target: Fix recursive locking in __configfs_open_file()

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix recursive locking in __configfs_open_file()

In flush_write_buffer, &p->frag_sem is acquired and then the loaded store

function is called, which, here, is target_core_item_dbroot_store(). This

function called filp_open(), following which these functions were called

(in reverse order), according to the call trace:

down_read

__configfs_open_file

do_dentry_open

vfs_open

do_open

path_openat

do_filp_open

file_open_name

filp_open

target_core_item_dbroot_store

flush_write_buffer

configfs_write_iter

target_core_item_dbroot_store() tries to validate the new file path by

trying to open the file path provided to it; however, in this case, the bug

report shows:

db_root: not a directory: /sys/kernel/config/target/dbroot

indicating that the same configfs file was tried to be opened, on which it

is currently working on. Thus, it is trying to acquire frag_sem semaphore

of the same file of which it already holds the semaphore obtained in

flush_write_buffer(), leading to acquiring the semaphore in a nested manner

and a possibility of recursive locking.

Fix this by modifying target_core_item_dbroot_store() to use kern_path()

instead of filp_open() to avoid opening the file using filesystem-specific

function __configfs_open_file(), and further modifying it to make this fix

compatible.