CVE-2026-72085

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Xen SCSI backend where scsiback get pend req() returns a vscsibk pend with an uninitialized se cmd (where cmd kref is 0). In scsiback do cmd fn(), two error paths—triggered by a failed scsiback gnttab data map() or an unknown ring req.act—call transport generic free cmd(), which performs a kref put() on the zeroed refcount. This leads to a refcount underflow and a use-after-free condition, causing the command tag to leak. A pvSCSI guest can exploit this by submitting requests with an unknown request type or a bad grant reference to leak all command tags of a LUN session, effectively stopping the LUN. Additionally, if panic on warn is enabled, the refcount underflow can cause the host to panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.