CVE-2026-72086

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel's SCSI xen scsiback component where the scsiback device action() function fails to free a command tag when a task-management request submitted via target submit tmr() returns an error. This occurs because the execution jumps to an error label that sends a response without releasing the tag obtained in scsiback get pend req(). A pvSCSI guest can exploit this by issuing VSCSIIF ACT SCSI ABORT or RESET requests to leak command tags of a LUN's session, which can lead to the LUN stopping. The issue is complicated by the fact that transport generic free cmd() cannot be used due to the state of se cmd->cmd kref and the risk of a double-free of se tmr req via target free cmd mem() after core tmr release req() has already been executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.