CVE-2026-23296scsi: core: Fix refcount leak for tagset_refcnt
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid" #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4 #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0 #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6 #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f818708eeeae793e12dc39f8984ed7732048a7d9 before 0e274674714427dc578bb99db5b86e312d2b57f8; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before 9f5e4abed9248448aa1b45b12ab0bea4d329b56a; 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 builds before 7c01b680beaf4d3143866b062b8e770e8b237fb8; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before ec5c17c687b189dbc09dfdec11b669caa40bc395; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before 944a333c8e4d42256556c1d2ebb6d773a33e0dcd; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before a03d96598d39fdf605d90731db3ef3b13fb8bdc8; 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 builds before 1ac22c8eae81366101597d48360718dff9b9d980; 5ce8fad941233e81f2afb5b52a3fcddd3ba8732f; and 4 more ranges | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.10.223 before 5.11; from 5.15.164 before 5.15.203; from 5.19.12 before 6.0; from 6.0.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/0e274674714427dc578bb99db5b86e312d2b57f8patch
- https://git.kernel.org/stable/c/9f5e4abed9248448aa1b45b12ab0bea4d329b56apatch
- https://git.kernel.org/stable/c/7c01b680beaf4d3143866b062b8e770e8b237fb8patch
- https://git.kernel.org/stable/c/ec5c17c687b189dbc09dfdec11b669caa40bc395patch
- https://git.kernel.org/stable/c/944a333c8e4d42256556c1d2ebb6d773a33e0dcdpatch
- https://git.kernel.org/stable/c/a03d96598d39fdf605d90731db3ef3b13fb8bdc8patch
- https://git.kernel.org/stable/c/1ac22c8eae81366101597d48360718dff9b9d980patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.