VulnerabilityPublished 23 Oct 2026

CVE-2026-99019: Linux kernel · scsi: ch: Do not keep references to data transfer element devices

Source GCVE Database

Authoritative record:CVE-2026-99019· Medium

Not known to be exploited · fixed in ec6ecab1b7577ae555ee6b81480814d123dd9ec0 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ec6ecab1b7577ae555ee6b81480814d123dd9ec0, cef2cedb6f7a394b278775b3d6ffb9b20ecd61db, a34a230ccea1b8b667ae59dca11295a2c8f81738 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-3xf5-26fr-5wmr

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ daa6eda65a53e5addf86c6bc829129ff51b08bda, < ec6ecab1b7577ae555ee6b81480814d123dd9ec0	Fixed in ec6ecab1b7577ae555ee6b81480814d123dd9ec0
LinuxLinux	Affected ≥ daa6eda65a53e5addf86c6bc829129ff51b08bda, < cef2cedb6f7a394b278775b3d6ffb9b20ecd61db	Fixed in cef2cedb6f7a394b278775b3d6ffb9b20ecd61db
LinuxLinux	Affected ≥ daa6eda65a53e5addf86c6bc829129ff51b08bda, < a34a230ccea1b8b667ae59dca11295a2c8f81738	Fixed in a34a230ccea1b8b667ae59dca11295a2c8f81738
LinuxLinux	Affected ≥ daa6eda65a53e5addf86c6bc829129ff51b08bda, < 27c0f718d3b3c99e6d315308e95d987d0382a8a8	Fixed in 27c0f718d3b3c99e6d315308e95d987d0382a8a8
LinuxLinux	Affected ≥ daa6eda65a53e5addf86c6bc829129ff51b08bda, < 1d35a17f1c2ed4154731895694a1a3557f0da766	Fixed in 1d35a17f1c2ed4154731895694a1a3557f0da766
LinuxLinux	Affected =2.6.13	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged.

References

Community reviews

Loading reviews…