---
id: CVE-2026-43054
title: 'scsi: target: tcm_loop: Drain commands in target_reset handler'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: target: tcm_loop: Drain commands in target_reset handler

  tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS
  without draining any in-flight…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    757c43c692294cdfad31390accc0e90429b2ef8a
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    103f79e4949513247d763c6e7f3cbbf62017afdf
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    15f5241d5a52364a7e7867b49128b0442dbcad9d
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    7cbd69aaa507b1245240a28022bf5da0f07c68d9
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    a836054ea81014117ec6b73529a21626a9e1f829
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    05ac3754467363558a0a54ae4bb7c89b2c9574cf
  - >-
    Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 <
    1333eee56cdf3f0cf67c6ab4114c2c9e0a952026
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:27:27.923024Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:28.903Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43054'
references:
  - url: 'https://git.kernel.org/stable/c/757c43c692294cdfad31390accc0e90429b2ef8a'
  - url: 'https://git.kernel.org/stable/c/103f79e4949513247d763c6e7f3cbbf62017afdf'
  - url: 'https://git.kernel.org/stable/c/15f5241d5a52364a7e7867b49128b0442dbcad9d'
  - url: 'https://git.kernel.org/stable/c/7cbd69aaa507b1245240a28022bf5da0f07c68d9'
  - url: 'https://git.kernel.org/stable/c/a836054ea81014117ec6b73529a21626a9e1f829'
  - url: 'https://git.kernel.org/stable/c/05ac3754467363558a0a54ae4bb7c89b2c9574cf'
  - url: 'https://git.kernel.org/stable/c/1333eee56cdf3f0cf67c6ab4114c2c9e0a952026'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01492
ingestedAt: '2026-11-06T15:54:04.030Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcm_loop: Drain commands in target_reset handler

tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS
without draining any in-flight commands.  The SCSI EH documentation
(scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver
has made lower layers "forget about timed out scmds" and is ready for new
commands.  Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug,
mpi3mr) enforces this by draining or completing outstanding commands before
returning SUCCESS.

Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight
scsi_cmnd structures for recovery commands (e.g. TUR) while the target core
still has async completion work queued for the old se_cmd.  The memset in
queuecommand zeroes se_lun and lun_ref_active, causing
transport_lun_remove_cmd() to skip its percpu_ref_put().  The leaked LUN
reference prevents transport_clear_lun_ref() from completing, hanging
configfs LUN unlink forever in D-state:

  INFO: task rm:264 blocked for more than 122 seconds.
  rm              D    0   264    258 0x00004000
  Call Trace:
   __schedule+0x3d0/0x8e0
   schedule+0x36/0xf0
   transport_clear_lun_ref+0x78/0x90 [target_core_mod]
   core_tpg_remove_lun+0x28/0xb0 [target_core_mod]
   target_fabric_port_unlink+0x50/0x60 [target_core_mod]
   configfs_unlink+0x156/0x1f0 [configfs]
   vfs_unlink+0x109/0x290
   do_unlinkat+0x1d5/0x2d0

Fix this by making tcm_loop_target_reset() actually drain commands:

 1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that
    the target core knows about (those not yet CMD_T_COMPLETE).

 2. Use blk_mq_tagset_busy_iter() to iterate all started requests and
    flush_work() on each se_cmd — this drains any deferred completion work
    for commands that already had CMD_T_COMPLETE set before the TMR (which
    the TMR skips via __target_check_io_state()).  This is the same pattern
    used by mpi3mr, scsi_debug, and libsas to drain outstanding commands
    during reset.

## Affected

- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 757c43c692294cdfad31390accc0e90429b2ef8a`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 103f79e4949513247d763c6e7f3cbbf62017afdf`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 15f5241d5a52364a7e7867b49128b0442dbcad9d`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 7cbd69aaa507b1245240a28022bf5da0f07c68d9`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < a836054ea81014117ec6b73529a21626a9e1f829`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 05ac3754467363558a0a54ae4bb7c89b2c9574cf`
- `Linux >= e0eb5d38b732b011cd9ed5b1bf9f59b83c2500d3 < 1333eee56cdf3f0cf67c6ab4114c2c9e0a952026`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.