CVE-2026-99156: scsi: st: Fix use-after-free race between st_remove() and st_open()

In the Linux kernel, the following vulnerability has been resolved:

scsi: st: Fix use-after-free race between stremove() and stopen()

stremove() drops the probe reference on the scsitape with krefput() and only afterwards removes its index from stindexidr. If that was the last reference, scsitaperelease() frees the structure while it is still published in the idr.

scsitapeget(), called from stopen(), looks up the tape in stindexidr and takes a reference under strefmutex and stindexlock. removecdevs() does not wait for opens that are already past chrdevopen(), so an open that is blocked on strefmutex while stremove() holds it can take the mutex as soon as stremove() drops it, find the freed tpnt in the idr and call krefget() on it:

BUG: KASAN: slab-use-after-free in stopen Write of size 4 ... stopen (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdevopen ... Freed by task ...: kfree stremove (drivers/scsi/st.c:4512)

Remove the index from the idr before dropping the reference, all under strefmutex. A concurrent scsitapeget() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so stopen() fails with -ENXIO.

This restores the ordering stremove() had before the conversion to stindexidr, where the tape was unpublished from scsitapes[] before the final krefput().