VulnerabilityPublished 28 Oct 2026

CVE-2026-99156: Linux kernel · scsi: st: Fix use-after-free race between st_remove() and st_open()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in a1647b653549ff29f0422a63eabf329b842f3822 : update Linux kernel when convenient.

Data as of 28 Oct 2026, 10:58 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Patch: Available – fixed in a1647b653549ff29f0422a63eabf329b842f3822, 71caf7f84bd62a4bf91cc95abd2de690afb8d15f, 18a0e3733ce38718688e813e5e2d1106bd4830e5

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to a1647b653549ff29f0422a63eabf329b842f3822, 71caf7f84bd62a4bf91cc95abd2de690afb8d15f or 18a0e3733ce38718688e813e5e2d1106bd4830e5.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6c648d95a6af4a79241a916871df17c84c68ea20, < a1647b653549ff29f0422a63eabf329b842f3822	Fixed in a1647b653549ff29f0422a63eabf329b842f3822
LinuxLinux	Affected ≥ 6c648d95a6af4a79241a916871df17c84c68ea20, < 71caf7f84bd62a4bf91cc95abd2de690afb8d15f	Fixed in 71caf7f84bd62a4bf91cc95abd2de690afb8d15f
LinuxLinux	Affected ≥ 6c648d95a6af4a79241a916871df17c84c68ea20, < 18a0e3733ce38718688e813e5e2d1106bd4830e5	Fixed in 18a0e3733ce38718688e813e5e2d1106bd4830e5
LinuxLinux	Affected =3.7	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put().

References

Community reviews

Loading reviews…