---
id: CVE-2026-99156
title: 'scsi: st: Fix use-after-free race between st_remove() and st_open()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: st: Fix use-after-free race between st_remove() and st_open()

  st_remove() drops the probe reference on the scsi_tape with kref_put()
  and only afterwards removes …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 <
    a1647b653549ff29f0422a63eabf329b842f3822
  - >-
    Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 <
    18a0e3733ce38718688e813e5e2d1106bd4830e5
  - >-
    Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 <
    71caf7f84bd62a4bf91cc95abd2de690afb8d15f
  - Linux 3.7
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:10.493Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99156'
references:
  - url: 'https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822'
  - url: 'https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5'
  - url: 'https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.401Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: st: Fix use-after-free race between st_remove() and st_open()

st_remove() drops the probe reference on the scsi_tape with kref_put()
and only afterwards removes its index from st_index_idr. If that was the
last reference, scsi_tape_release() frees the structure while it is
still published in the idr.

scsi_tape_get(), called from st_open(), looks up the tape in
st_index_idr and takes a reference under st_ref_mutex and
st_index_lock. remove_cdevs() does not wait for opens that are already
past chrdev_open(), so an open that is blocked on st_ref_mutex while
st_remove() holds it can take the mutex as soon as st_remove() drops it,
find the freed tpnt in the idr and call kref_get() on it:

  BUG: KASAN: slab-use-after-free in st_open
  Write of size 4 ...
   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)
   chrdev_open
  ...
  Freed by task ...:
   kfree
   st_remove (drivers/scsi/st.c:4512)

Remove the index from the idr before dropping the reference, all under
st_ref_mutex. A concurrent scsi_tape_get() now either runs first and
holds a valid reference that keeps the tape alive, or runs afterwards
and finds nothing, so st_open() fails with -ENXIO.

This restores the ordering st_remove() had before the conversion to
st_index_idr, where the tape was unpublished from scsi_tapes[] before
the final kref_put().

## Affected

- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < a1647b653549ff29f0422a63eabf329b842f3822`
- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 18a0e3733ce38718688e813e5e2d1106bd4830e5`
- `Linux >= 6c648d95a6af4a79241a916871df17c84c68ea20 < 71caf7f84bd62a4bf91cc95abd2de690afb8d15f`
- `Linux 3.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.