Description
In the Linux kernel, the following vulnerability has been resolved:

scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the se_cmd is initialised (kref_init() via target_init_cmd()) only
later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB
path. The two error paths in scsiback_do_cmd_fn() taken before the
command is submitted -- a failed scsiback_gnttab_data_map() and an
unknown ring_req.act -- call
transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a
refcount of 0. That underflows it ("refcount_t: underflow;
use-after-free") and, as the release function is not run, leaks the
command tag.

Impact: a pvSCSI guest can leak every command tag of a LUN's session,
stopping the LUN, by submitting requests with a bad grant reference or
an unknown request type; under panic_on_warn the refcount underflow
panics the host.

Add a helper that just returns the tag with target_free_tag() and sends
the error response. It frees the tag while the v2p reference still pins
the session, and snapshots the response fields beforehand because
freeing the tag can let another ring reuse the pending_req slot.
Published: 2026-08-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The kernel bug causes a reference count underflow on an unsubmitted SCSI command in xen scsiback. When a pvSCSI guest sends a bad grant reference or an unknown request type, the underflow can leak all command tags of the LUN session or trigger a kernel panic under panic_on_warn. The result is a denial of service that can stop the virtual LUN or crash the host.

Affected Systems

All Linux kernel releases that include xen scsiback before the containment patch are affected. The issue applies to the generic Linux kernel and any distribution kernel that has not yet integrated the fix.

Risk and Exploitability

The vulnerability offers a path for guests running under Xen to emphasize kernel resource exhaustion. The CVSS score of 9.3 indicates a critical severity. The EPSS score indicates an exploitation probability of less than 1%, showing a very low but non‑zero likelihood of being exploited, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a guest capable of constructing malformed SCSI requests, which is inferred from the description of the issue.

Generated by OpenCVE AI on August 18, 2026 at 04:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a Linux kernel update that includes the scsiback refcount underflow fix
  • If using a distribution kernel, obtain and install the vendor’s security patch that incorporates this fix
  • Upgrade the Xen hypervisor to the latest stable release to ensure all related components are patched

Generated by OpenCVE AI on August 18, 2026 at 04:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-416

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 17 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0; the se_cmd is initialised (kref_init() via target_init_cmd()) only later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB path. The two error paths in scsiback_do_cmd_fn() taken before the command is submitted -- a failed scsiback_gnttab_data_map() and an unknown ring_req.act -- call transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a refcount of 0. That underflows it ("refcount_t: underflow; use-after-free") and, as the release function is not run, leaks the command tag. Impact: a pvSCSI guest can leak every command tag of a LUN's session, stopping the LUN, by submitting requests with a bad grant reference or an unknown request type; under panic_on_warn the refcount underflow panics the host. Add a helper that just returns the tag with target_free_tag() and sends the error response. It frees the tag while the v2p reference still pins the session, and snapshots the response fields beforehand because freeing the tag can let another ring reuse the pending_req slot.
Title scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:40:07.854Z

Reserved: 2026-08-09T03:40:39.904Z

Link: CVE-2026-72085

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:22.470

Modified: 2026-08-17T06:18:07.370

Link: CVE-2026-72085

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72085 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T04:45:04Z

Weaknesses
  • CWE-911

    Improper Update of Reference Count