Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: xen: scsiback: Instead of permanently removing unsubmitted commands, they are simply freed. The scsibackgetpendreq function retrieves a command tag and returns a vscsibkpend structure. The secmd embedded in this structur...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Fixed a potential memory leak in scsibackremove. The memory allocated for the struct vscsiblkinfo structure in scsibackprobe is not freed in scsibackRemove, resulting in potential memory leaks during the...

SUSE CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

SUSE CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72086

A flaw was found in the Linux kernel's scsi: xen: scsiback component. A pvSCSI guest can trigger a resource leak by issuing specific SCSI Small Computer System Interface requests when a task management operation fails. This vulnerability allows the guest to leak command tags associated with a...

CVE-2026-72085

A flaw was found in the Linux kernel's scsi: xen: scsiback component. This vulnerability allows a malicious virtualized SCSI pvSCSI guest to trigger a reference count underflow by sending specially crafted requests. This can lead to a denial of service, potentially stopping a Logical Unit Number...

CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

UBUNTU-CVE-2026-72086

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

CVE-2026-72086

The CVE-2026-72086 entry describes a Linux kernel vulnerability in the pvSCSI/scsiback path for Xen where, on the TMR submit-failure path, a command tag could be leaked instead of freed. Specifically, scsiback_device_action() obtains a tag, submits target_submit_tmr(), and on failure the err path...

EUVD-2026-59044

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

EUVD-2026-59043

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

PT-2026-72274

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Xen SCSI backend where scsiback get pend req returns a vscsibk pend with an uninitialized se cmd where cmd kref is 0. In scsiback do cmd fn, two error...

CVE-2026-72086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

PT-2026-72275

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's SCSI xen scsiback component where the scsiback device action function fails to free a command tag when a task-management request submitted via targe...

CVE-2026-72085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

Linux Distros Unpatched Vulnerability : CVE-2026-72085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded sec...