{"id":"CVE-2026-99156","aliases":[],"title":"scsi: st: Fix use-after-free race between st_remove() and st_open()","titleSource":"Linux","descriptionSource":"Linux","products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","status":"affected","lessThan":"a1647b653549ff29f0422a63eabf329b842f3822","versionType":"git"},{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","status":"affected","lessThan":"18a0e3733ce38718688e813e5e2d1106bd4830e5","versionType":"git"},{"version":"6c648d95a6af4a79241a916871df17c84c68ea20","status":"affected","lessThan":"71caf7f84bd62a4bf91cc95abd2de690afb8d15f","versionType":"git"}],"defaultStatus":"unaffected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99156"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"3.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.7","versionType":"semver"},{"version":"6.18.59","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.13","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99156"}],"remediation":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n  BUG: KASAN: slab-use-after-free in st_open\n  Write of size 4 ...\n   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n   chrdev_open\n  ...\n  Freed by task ...:\n   kfree\n   st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put().","severity":"unknown","score":null,"published":"2026-10-28T10:35:10.493Z","modified":"2026-10-28T10:35:10.493Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822","https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5","https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"],"sources":[{"name":"CVE","id":"CVE-2026-99156","modified":"2026-10-28T10:35:10.493Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-99156"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:45:31.448Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}