« Volver al listado

CVE-2026-72085

Estado: RecibidaCrítica (9.3)—

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0; the se_cmd is initialised (kref_init() via target_init_cmd()) only later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB path.

Leer descripción completaMostrar menos

The two error paths in scsiback_do_cmd_fn() taken before the command is submitted -- a failed scsiback_gnttab_data_map() and an unknown ring_req.act -- call transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a refcount of 0. That underflows it ("refcount_t: underflow; use-after-free") and, as the release function is not run, leaks the command tag.

Impact: a pvSCSI guest can leak every command tag of a LUN's session, stopping the LUN, by submitting requests with a bad grant reference or an unknown request type; under panic_on_warn the refcount underflow panics the host.

Add a helper that just returns the tag with target_free_tag() and sends the error response. It frees the tag while the v2p reference still pins the session, and snapshots the response fields beforehand because freeing the tag can let another ring reuse the pending_req slot.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L/PR:N/UI:N) a kernel Linux permite denial of service por agotamiento de recursos (command tag leak) e intentos de panics refcount; aplica T1068 como vector de explotación local.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72085",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "9c0f6894982b1f13bda220707497b25ac9c95bdb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "a13b789497a7fdd27d4d63f5c69d23db706ef0fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "fa588f28401102652068c4cc75e135507f4b5106",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "fcd64d4d97af5d9736f31040f8ed8cd4c17e4c45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "f1516c56ac540da1769f264c3cfefe4499548a5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "1e97c404e44991fb087c38ccd7414f2d326f9b74",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
              "lessThan": "ca978f8a93d4d36841839bf2847d29b88c2591d6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/xen/xen-scsiback.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/xen/xen-scsiback.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:22.470",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1e97c404e44991fb087c38ccd7414f2d326f9b74",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c0f6894982b1f13bda220707497b25ac9c95bdb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a13b789497a7fdd27d4d63f5c69d23db706ef0fe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca978f8a93d4d36841839bf2847d29b88c2591d6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f1516c56ac540da1769f264c3cfefe4499548a5d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa588f28401102652068c4cc75e135507f4b5106",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fcd64d4d97af5d9736f31040f8ed8cd4c17e4c45",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen: scsiback: Free unsubmitted command instead of double-putting it\n\nscsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend\nwhose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;\nthe se_cmd is initialised (kref_init() via target_init_cmd()) only\nlater, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB\npath. The two error paths in scsiback_do_cmd_fn() taken before the\ncommand is submitted -- a failed scsiback_gnttab_data_map() and an\nunknown ring_req.act -- call\ntransport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a\nrefcount of 0. That underflows it (\"refcount_t: underflow;\nuse-after-free\") and, as the release function is not run, leaks the\ncommand tag.\n\nImpact: a pvSCSI guest can leak every command tag of a LUN's session,\nstopping the LUN, by submitting requests with a bad grant reference or\nan unknown request type; under panic_on_warn the refcount underflow\npanics the host.\n\nAdd a helper that just returns the tag with target_free_tag() and sends\nthe error response. It frees the tag while the v2p reference still pins\nthe session, and snapshots the response fields beforehand because\nfreeing the tag can let another ring reuse the pending_req slot."
    }
  ],
  "lastModified": "2026-08-17T06:18:07.370",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}