CVE-2026-99019

The Linux kernel contains a vulnerability in the scsi changer (ch) component where the ch_readconfig() function incorrectly maintains references to data transfer element devices . Because scsi_device_lookup() takes a reference that is never dropped, removed drives remain on the host's device list...