---
id: CVE-2026-72086
title: 'scsi: xen: scsiback: Free the command tag on the TMR submit-failure path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

  scsiback_device_action() obtains a command tag in
  scsiback_get_pend_req() and submits a task-m…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    4567ce79fe2f84c3dcc3a91b22a377cf482d33ad
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    6c01f0439098f00a64b246dc27479602201382f7
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    18d4f86816592586b38513543b5e1f9553bc271f
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    fbc1bdede66d0f2cde83b75d6524ce1a815bb69f
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    255fb7b0cdc947b1c01929c7f133281342a3a6b5
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    1357fb32d42ad8da193e6da285f09e6452feabda
  - >-
    Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e <
    66aefc277ebb796ec285d550305535dc3fc0179f
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:51:20.477210Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:19.691Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72086'
references:
  - url: 'https://git.kernel.org/stable/c/4567ce79fe2f84c3dcc3a91b22a377cf482d33ad'
  - url: 'https://git.kernel.org/stable/c/6c01f0439098f00a64b246dc27479602201382f7'
  - url: 'https://git.kernel.org/stable/c/18d4f86816592586b38513543b5e1f9553bc271f'
  - url: 'https://git.kernel.org/stable/c/fbc1bdede66d0f2cde83b75d6524ce1a815bb69f'
  - url: 'https://git.kernel.org/stable/c/255fb7b0cdc947b1c01929c7f133281342a3a6b5'
  - url: 'https://git.kernel.org/stable/c/1357fb32d42ad8da193e6da285f09e6452feabda'
  - url: 'https://git.kernel.org/stable/c/66aefc277ebb796ec285d550305535dc3fc0179f'
tags:
  - cve.org
epss: 0.00212
epssPercentile: 0.11549
ingestedAt: '2026-11-06T18:00:12.597Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

scsiback_device_action() obtains a command tag in
scsiback_get_pend_req() and submits a task-management request with
target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
scsiback jumps to the err: label, which sends a response but frees
nothing, leaking the tag.

Impact: a pvSCSI guest can leak the command tags of a LUN's session,
stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
whenever target_submit_tmr() fails.

transport_generic_free_cmd() cannot be used here. By the time
target_submit_tmr() returns an error it has already run
__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
pointer dangling. Letting the command release run target_free_cmd_mem()
would then double-free se_tmr_req.

Use the same helper, which returns just the tag, on this path too.

## Affected

- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 4567ce79fe2f84c3dcc3a91b22a377cf482d33ad`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 6c01f0439098f00a64b246dc27479602201382f7`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 18d4f86816592586b38513543b5e1f9553bc271f`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < fbc1bdede66d0f2cde83b75d6524ce1a815bb69f`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 255fb7b0cdc947b1c01929c7f133281342a3a6b5`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 1357fb32d42ad8da193e6da285f09e6452feabda`
- `Linux >= 2dbcdf33dbf61f44b29adb52338282c3d7840d0e < 66aefc277ebb796ec285d550305535dc3fc0179f`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.