Junglewise Threat Intelligence

CVE-2026-23296: Linux Kernel reference count leak in SCSI core

CVE-2026-23296 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SCSI subsystem can cause the system to hang or become unresponsive when disconnecting storage devices. This occurs due to a resource management error (reference count leak) during the removal of SCSI hosts, such as those used in iSCSI environments. An attacker with local access could potentially trigger this condition to cause a denial of service, impacting system availability and storage operations.

Technical details

A reference count leak exists in the tagset_refcnt within the Linux kernel's SCSI core, specifically in the scsi_alloc_sdev function in drivers/scsi/scsi_scan.c. The root cause is a failure to decrement the reference count (kref_put) when scsi_realloc_sdev_budget_map fails during SCSI device allocation. This leak prevents the proper teardown of SCSI hosts, causing processes like iscsid to hang indefinitely in a wait state (e.g., during scsi_remove_host). The vulnerability is reachable by local users and can be triggered during SCSI scanning or host removal operations. Patches have been released across multiple stable kernel branches to ensure kref_put is called in the error path.

Affected products

  • Linux Linux Kernel 5.10.223 to 5.11; 5.15.164 to 5.15.203; 5.19.12 to 6.0; 6.0.1 to 6.1.167; 6.2 to 6.6.130; 6.7 to 6.12.77; 6.13 to 6.18.17; 6.19 to 6.19.7; 7.0-rc1 to 7.0-rc2

Timeline

  • 2026-03-25: disclosed: Initial disclosure of the vulnerability and fix.
  • 2026-03-25: advisory: CVE-2026-23296 published.

References