{"id":"CVE-2026-72086","title":"scsi: xen: scsiback: Free the command tag on the TMR submit-failure path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen: scsiback: Free the command tag on the TMR submit-failure path\n\nscsiback_device_action() obtains a command tag in\nscsiback_get_pend_req() and submits a task-m…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 4567ce79fe2f84c3dcc3a91b22a377cf482d33ad","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 6c01f0439098f00a64b246dc27479602201382f7","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 18d4f86816592586b38513543b5e1f9553bc271f","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < fbc1bdede66d0f2cde83b75d6524ce1a815bb69f","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 255fb7b0cdc947b1c01929c7f133281342a3a6b5","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 1357fb32d42ad8da193e6da285f09e6452feabda","Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 66aefc277ebb796ec285d550305535dc3fc0179f","Linux 4.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:51:20.477210Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:19.691Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72086","references":[{"url":"https://git.kernel.org/stable/c/4567ce79fe2f84c3dcc3a91b22a377cf482d33ad"},{"url":"https://git.kernel.org/stable/c/6c01f0439098f00a64b246dc27479602201382f7"},{"url":"https://git.kernel.org/stable/c/18d4f86816592586b38513543b5e1f9553bc271f"},{"url":"https://git.kernel.org/stable/c/fbc1bdede66d0f2cde83b75d6524ce1a815bb69f"},{"url":"https://git.kernel.org/stable/c/255fb7b0cdc947b1c01929c7f133281342a3a6b5"},{"url":"https://git.kernel.org/stable/c/1357fb32d42ad8da193e6da285f09e6452feabda"},{"url":"https://git.kernel.org/stable/c/66aefc277ebb796ec285d550305535dc3fc0179f"}],"tags":["cve.org"],"epss":0.00212,"epssPercentile":0.11549,"ingestedAt":"2026-11-06T18:00:12.597Z","slug":"CVE-2026-72086","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen: scsiback: Free the command tag on the TMR submit-failure path\n\nscsiback_device_action() obtains a command tag in\nscsiback_get_pend_req() and submits a task-management request with\ntarget_submit_tmr(). When target_submit_tmr() fails it returns < 0 and\nscsiback jumps to the err: label, which sends a response but frees\nnothing, leaking the tag.\n\nImpact: a pvSCSI guest can leak the command tags of a LUN's session,\nstopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests\nwhenever target_submit_tmr() fails.\n\ntransport_generic_free_cmd() cannot be used here. By the time\ntarget_submit_tmr() returns an error it has already run\n__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its\ntarget_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via\ncore_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the\npointer dangling. Letting the command release run target_free_cmd_mem()\nwould then double-free se_tmr_req.\n\nUse the same helper, which returns just the tag, on this path too.\n\n## Affected\n\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 4567ce79fe2f84c3dcc3a91b22a377cf482d33ad`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 6c01f0439098f00a64b246dc27479602201382f7`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 18d4f86816592586b38513543b5e1f9553bc271f`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < fbc1bdede66d0f2cde83b75d6524ce1a815bb69f`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 255fb7b0cdc947b1c01929c7f133281342a3a6b5`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 1357fb32d42ad8da193e6da285f09e6452feabda`\n- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 66aefc277ebb796ec285d550305535dc3fc0179f`\n- `Linux 4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}