Medium 5.5Published Mar 25, 2026

CVE-2026-23296scsi: core: Fix refcount leak for tagset_refcnt

Updated under an hour ago (Oct 27, 2026, 1:00 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid" #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4 #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0 #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6 #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f818708eeeae793e12dc39f8984ed7732048a7d9 before 0e274674714427dc578bb99db5b86e312d2b57f8; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before 9f5e4abed9248448aa1b45b12ab0bea4d329b56a; 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 builds before 7c01b680beaf4d3143866b062b8e770e8b237fb8; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before ec5c17c687b189dbc09dfdec11b669caa40bc395; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before 944a333c8e4d42256556c1d2ebb6d773a33e0dcd; from 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 before a03d96598d39fdf605d90731db3ef3b13fb8bdc8; 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 builds before 1ac22c8eae81366101597d48360718dff9b9d980; 5ce8fad941233e81f2afb5b52a3fcddd3ba8732f; and 4 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.10.223 before 5.11; from 5.15.164 before 5.15.203; from 5.19.12 before 6.0; from 6.0.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0e274674714427dc578bb99db5b86e312d2b57f8	patch
https://git.kernel.org/stable/c/9f5e4abed9248448aa1b45b12ab0bea4d329b56a	patch
https://git.kernel.org/stable/c/7c01b680beaf4d3143866b062b8e770e8b237fb8	patch
https://git.kernel.org/stable/c/ec5c17c687b189dbc09dfdec11b669caa40bc395	patch
https://git.kernel.org/stable/c/944a333c8e4d42256556c1d2ebb6d773a33e0dcd	patch
https://git.kernel.org/stable/c/a03d96598d39fdf605d90731db3ef3b13fb8bdc8	patch
https://git.kernel.org/stable/c/1ac22c8eae81366101597d48360718dff9b9d980	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.