{"id":"CVE-2026-23296","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10.223, < 5.11","linux_kernel >= 5.15.164, < 5.15.203","linux_kernel >= 5.19.12, < 6.0","linux_kernel >= 6.0.1, < 6.1.167","linux_kernel >= 6.2, < 6.6.130","linux_kernel >= 6.7, < 6.12.77","linux_kernel >= 6.13, < 6.18.17","linux_kernel >= 6.19, < 6.19.7","linux_kernel = 6.0","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.7"],"published":"2026-03-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:47.967","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23296","references":[{"url":"https://git.kernel.org/stable/c/0e274674714427dc578bb99db5b86e312d2b57f8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ac22c8eae81366101597d48360718dff9b9d980","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c01b680beaf4d3143866b062b8e770e8b237fb8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/944a333c8e4d42256556c1d2ebb6d773a33e0dcd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f5e4abed9248448aa1b45b12ab0bea4d329b56a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a03d96598d39fdf605d90731db3ef3b13fb8bdc8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec5c17c687b189dbc09dfdec11b669caa40bc395","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00123,"epssPercentile":0.01845,"ingestedAt":"2026-10-15T03:30:12.840Z","slug":"CVE-2026-23296","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\n\nPID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: \"iscsid\"\n #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef\n\n## Affected\n\n- `linux_kernel >= 5.10.223, < 5.11`\n- `linux_kernel >= 5.15.164, < 5.15.203`\n- `linux_kernel >= 5.19.12, < 6.0`\n- `linux_kernel >= 6.0.1, < 6.1.167`\n- `linux_kernel >= 6.2, < 6.6.130`\n- `linux_kernel >= 6.7, < 6.12.77`\n- `linux_kernel >= 6.13, < 6.18.17`\n- `linux_kernel >= 6.19, < 6.19.7`\n- `linux_kernel = 6.0`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.7`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}