CVE-2026-43054
SCSI Target Loop Driver Command Drain Failure in Linux Kernel
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux_kernel | tcm_loop | * |
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SCSI target driver tcm_loop. The function tcm_loop_target_reset() violates the SCSI error handling contract by returning SUCCESS without properly draining any in-flight SCSI commands. According to the SCSI error handling documentation, when a reset handler returns SUCCESS, it must ensure that all timed-out commands are forgotten and the driver is ready for new commands.
Because tcm_loop_target_reset() does not drain these commands, the system reuses command structures for recovery commands while the target core still has asynchronous completion work queued for the old commands. This causes certain references to leak, preventing the completion of LUN (Logical Unit Number) unlink operations and causing processes to hang indefinitely in an uninterruptible sleep state.
The fix involves making tcm_loop_target_reset() properly drain commands by issuing a LUN reset to clear all known commands and iterating over started requests to flush any deferred completion work, ensuring no commands remain pending before returning SUCCESS.
How can this vulnerability impact me? :
This vulnerability can cause processes that attempt to unlink SCSI LUNs to hang indefinitely in an uninterruptible sleep state (D-state). This happens because leaked references prevent the completion of LUN unlink operations, leading to resource leaks and potential system instability.
In practical terms, this means that storage devices managed by the affected driver may not be properly removed or reset, potentially causing system hangs or degraded performance when managing SCSI targets.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes the configfs LUN unlink operation to hang indefinitely in a D-state, which can be detected by observing blocked tasks related to LUN removal.
You can look for system logs or kernel messages indicating tasks blocked for extended periods, such as messages showing a process stuck in D-state with call traces involving transport_clear_lun_ref, core_tpg_remove_lun, or configfs_unlink.
Specific commands to detect this condition include:
- Check for blocked tasks in D-state using: ps aux | grep ' D '
- Examine kernel logs for hung tasks or call traces: dmesg | grep -i 'blocked' or dmesg | grep -i 'transport_clear_lun_ref'
- Use system monitoring tools like top or htop to identify processes stuck in uninterruptible sleep (D-state).
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that the tcm_loop_target_reset() function properly drains all in-flight SCSI commands before returning success.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- If updating is not immediately possible, avoid using the tcm_loop target driver or disable it if feasible.
- Monitor for symptoms such as hung configfs LUN unlink operations and blocked tasks in D-state, and restart affected services or the system if necessary.