CVE-2026-23296
Reference Count Leak in Linux SCSI Core Causes Host Hang
Publication date: 2026-03-25
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reference count leak in the Linux kernel's SCSI core, specifically related to the tagset_refcnt. The leak causes a hang when tearing down the SCSI host, which can lead to processes like iscsid becoming unresponsive.
The issue manifests as an allocation failure during SCSI scanning, preventing some SCSI devices from being configured properly.
How can this vulnerability impact me? :
This vulnerability can cause system hangs during the teardown of SCSI hosts, which may result in processes such as iscsid hanging and failing to manage SCSI devices correctly.
As a result, some SCSI devices might not be configured or accessible, potentially impacting system stability and availability of storage devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a reference count leak in the SCSI core, which leads to a hang when tearing down the SCSI host. One observable symptom is that the iscsid process hangs, and the kernel logs show messages like "scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured."
To detect this issue on your system, you can monitor the kernel logs for such error messages and check if the iscsid process is hanging.
- Use the command: dmesg | grep 'scsi_alloc_sdev' to look for allocation failure messages.
- Check if the iscsid process is unresponsive or stuck using: ps aux | grep iscsid
- Examine the kernel call trace in logs around the time of the hang for references to scsi_remove_host or iscsi_tcp modules.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by fixing the reference count leak in the SCSI core. Immediate mitigation involves updating the Linux kernel to a version that includes this fix.
Until the kernel is updated, you may experience hangs during SCSI host teardown, especially affecting iscsid. As a temporary measure, avoid restarting or tearing down SCSI hosts or iSCSI sessions unnecessarily.