{"id":"CVE-2026-99156","title":"scsi: st: Fix use-after-free race between st_remove() and st_open()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < a1647b653549ff29f0422a63eabf329b842f3822","Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 18a0e3733ce38718688e813e5e2d1106bd4830e5","Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 71caf7f84bd62a4bf91cc95abd2de690afb8d15f","Linux 3.7"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T10:35:10.493Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99156","references":[{"url":"https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"},{"url":"https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5"},{"url":"https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.401Z","slug":"CVE-2026-99156","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n  BUG: KASAN: slab-use-after-free in st_open\n  Write of size 4 ...\n   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n   chrdev_open\n  ...\n  Freed by task ...:\n   kfree\n   st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put().\n\n## Affected\n\n- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < a1647b653549ff29f0422a63eabf329b842f3822`\n- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 18a0e3733ce38718688e813e5e2d1106bd4830e5`\n- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 71caf7f84bd62a4bf91cc95abd2de690afb8d15f`\n- `Linux 3.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}