{"schema":"threatline.record/2","record":{"id":"CVE-2026-99156","aliases":[],"summary":"scsi: st: Fix use-after-free race between st_remove() and st_open()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n  BUG: KASAN: slab-use-after-free in st_open\n  Write of size 4 ...\n   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n   chrdev_open\n  ...\n  Freed by task ...:\n   kfree\n   st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put().","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99156","source_modified_at":"2026-10-28T10:35:10.493Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","lessThan":"a1647b653549ff29f0422a63eabf329b842f3822","status":"affected","versionType":"git"},{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","lessThan":"18a0e3733ce38718688e813e5e2d1106bd4830e5","status":"affected","versionType":"git"},{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","lessThan":"71caf7f84bd62a4bf91cc95abd2de690afb8d15f","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99156","source_modified_at":"2026-10-28T10:35:10.493Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99156","source_modified_at":"2026-10-28T10:35:10.493Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"18a0e3733ce38718688e813e5e2d1106bd4830e5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99156","source_modified_at":"2026-10-28T10:35:10.493Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"71caf7f84bd62a4bf91cc95abd2de690afb8d15f","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T10:35:10.493Z","modified_at":"2026-10-28T10:35:10.493Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-99156","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T10:35:10.493Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T10:35:10.493Z","content_hash":"9d01a50fabf2d125723c347079710e343346256697b55ae718e979d315cc7dc0"}}