CVE-2026-72088

The CVE-2026-72088 entry concerns the Linux kernel SCSI HPSA driver IOACCEL2 reset path. The root cause was a DMA mapping leak when phys_disk->in_reset is set, causing an early return without cleaning up resources allocated for the command. The fix adds proper error cleanup: unmapping the IOAC...

CVE-2026-72088 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

CVE-2026-72088 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

EUVD-2026-59044

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086

The CVE-2026-72086 entry describes a Linux kernel vulnerability in the pvSCSI/scsiback path for Xen where, on the TMR submit-failure path, a command tag could be leaked instead of freed. Specifically, scsiback_device_action() obtains a tag, submits target_submit_tmr(), and on failure the err path...

CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72085

CVE-2026-72085 concerns the Linux kernel SCSI xen scsiback path. A path in scsiback_get_pend_req() creates a pending command with an uninitialized or not-yet-kref’d se_cmd; if a submission is aborted via a bad grant or unknown ring_req.act, transport_generic_free_cmd() underflows the reference co...

EUVD-2026-59043

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72081

This CVE (CVE-2026-72081) concerns the Linux kernel SCSI elx/efct path. The issue occurs in efct_dispatch_fcp_cmd() which allocates an efct_io before dispatching an unsolicited FCP command; if the command includes an unsupported additional CDB, the function returns -EIO before handing the IO to t...

EUVD-2026-59039

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72081 scsi: elx: efct: Fix I/O leak on unsupported additional CDB

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72081

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72081 scsi: elx: efct: Fix I/O leak on unsupported additional CDB

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

CVE-2026-72075

In the Linux kernel, a race condition was fixed in the ims-pcu reset_device sysfs callback. The ims_pcu_reset_device() path called IMS_PCU_execute_command() without holding pcu->cmd_mutex, allowing data races and possible corruption of the shared command buffer when commands execute concurrent...

EUVD-2026-59033

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...