CVE-2026-72086: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
scsibackdeviceaction() obtains a command tag in scsibackgetpendreq() and submits a task-management request with targetsubmittmr(). When targetsubmittmr() fails it returns < 0 and scsiback jumps to the err: label, which sends a response but frees nothing, leaking the tag.
Impact: a pvSCSI guest can leak the command tags of a LUN's session, stopping the LUN, by issuing VSCSIIFACTSCSIABORT or RESET requests whenever targetsubmittmr() fails.
transportgenericfreecmd() cannot be used here. By the time targetsubmittmr() returns an error it has already run targetinitcmd() (so secmd->cmdkref is one, not zero), and on its targetgetsesscmd() error path it has freed secmd->setmrreq via coretmrreleasereq() while leaving SCFSCSITMRCDB set and the pointer dangling. Letting the command release run targetfreecmdmem() would then double-free setmrreq.
Use the same helper, which returns just the tag, on this path too.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72086?
CVE-2026-72086 has a risk score of 37.
How do I fix CVE-2026-72086?
To fix CVE-2026-72086, update your Linux kernel to the latest patched version where this vulnerability is resolved.
What is the impact of CVE-2026-72086 on system performance?
CVE-2026-72086 can potentially affect the reliability of SCSI commands, leading to possible data management issues.
In which Linux kernel versions is CVE-2026-72086 present?
CVE-2026-72086 is present in earlier versions of the Linux kernel prior to the security patch released on August 15, 2026.
Who is affected by CVE-2026-72086?
Users of the Linux kernel utilizing SCSI over Xen that rely on the scsiback driver may be affected by CVE-2026-72086.