scsi: st: Fix use-after-free race between st_remove() and st_open()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99156
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-28 11:17:35 UTC
Updated2026-10-31 13:17:57 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put().

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001830000 probability, percentile 0.079280000 (date 2026-10-31)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 7d7f9d2ee4b0841f3eba9fa3627044ad329428de git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 d9517fc39ec3ee13eadefdc17f45300f7d23ed8c git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7 git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 00ff1128123d4bdfacd28d68fb4b6e6f657a3648 git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 5ef230f734e0d23db007c8405f38b7e226740084 git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 a1647b653549ff29f0422a63eabf329b842f3822 git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 18a0e3733ce38718688e813e5e2d1106bd4830e5 git Not specified
CNA Linux Linux affected 6c648d95a6af4a79241a916871df17c84c68ea20 71caf7f84bd62a4bf91cc95abd2de690afb8d15f git Not specified
CNA Linux Linux affected 3.7 Not specified
CNA Linux Linux unaffected 3.7 semver Not specified
CNA Linux Linux unaffected 5.10.273 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.13 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report