CVE-2026-99156

In the Linux kernel, the following vulnerability has been resolved:

scsi: st: Fix use-after-free race between st remove() and st open()

st remove() drops the probe reference on the scsi tape with kref put() and only afterwards removes its index from st index idr. If that was the last reference, scsi tape release() frees the structure while it is still published in the idr.

scsi tape get(), called from st open(), looks up the tape in st index idr and takes a reference under st ref mutex and st index lock. remove cdevs() does not wait for opens that are already past chrdev open(), so an open that is blocked on st ref mutex while st remove() holds it can take the mutex as soon as st remove() drops it, find the freed tpnt in the idr and call kref get() on it:

BUG: KASAN: slab-use-after-free in st open Write of size 4 ... st open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev open ... Freed by task ...: kfree st remove (drivers/scsi/st.c:4512)

Remove the index from the idr before dropping the reference, all under st ref mutex. A concurrent scsi tape get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st open() fails with -ENXIO.

This restores the ordering st remove() had before the conversion to st index idr, where the tape was unpublished from scsi tapes[] before the final kref put().