CVE-2026-23296: Linux Kernel Privilege Escalation Flaw

CVE-2026-23296 Overview

CVE-2026-23296 is a refcount leak vulnerability in the Linux kernel's SCSI (Small Computer System Interface) core subsystem. The flaw resides in the handling of tagset_refcnt, where a missing reference release causes the SCSI host teardown path to hang indefinitely. Userspace daemons such as iscsid can stall when destroying iSCSI sessions, triggering kernel hangs visible through call traces involving scsi_remove_host and iscsi_sw_tcp_session_destroy. The condition is reachable during SCSI device allocation failure scenarios, where the leaked reference prevents the tagset from being torn down cleanly.

Critical Impact
The refcount leak produces a denial-of-service condition by hanging the SCSI host teardown process, blocking iSCSI session destruction and degrading storage subsystem availability.

Affected Products

Linux kernel SCSI core subsystem (drivers/scsi)
iSCSI software initiator (iscsi_tcp, scsi_transport_iscsi)
Linux distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-03-25 - CVE-2026-23296 published to NVD
2026-04-18 - Last updated in NVD database

Technical Details for CVE-2026-23296

Vulnerability Analysis

The vulnerability resides in the SCSI core's management of the block multi-queue tagset reference counter (tagset_refcnt). When scsi_alloc_sdev fails during SCSI scanning, the error path does not properly release a reference on the tagset. Because the teardown logic waits for the refcount to reach zero before completing, the leaked reference causes scsi_remove_host to block on a completion that never fires.

The captured call trace shows iscsid parked in __wait_for_common after invoking scsi_remove_host through iscsi_sw_tcp_session_destroy. The waiting task remains in uninterruptible sleep, holding netlink processing for the iSCSI transport. This produces a hung kernel task and prevents subsequent iSCSI operations from completing on the affected host.

The issue is classified as a [CWE-401] Missing Release of Memory After Effective Lifetime style defect applied to a reference counter rather than to memory directly.

Root Cause

The root cause is an unbalanced reference acquisition on tagset_refcnt in the SCSI device allocation failure path. The code increments the refcount during setup but omits the corresponding decrement when allocation fails, leaving the counter permanently above zero.

Attack Vector

The vulnerability is triggered by allocation failures during SCSI scanning, which can occur under memory pressure or when target enumeration produces transient errors. The condition is local and primarily impacts availability rather than confidentiality or integrity. No verified proof-of-concept code is published with this CVE, and the issue manifests through reliability symptoms during iSCSI logout or SCSI host removal.

The vulnerability mechanism is described in the upstream commit messages. See the Kernel Git Commit 0e27467 and related stable backports for technical details.

Detection Methods for CVE-2026-23296

Indicators of Compromise

Kernel log entries containing scsi_alloc_sdev: Allocation failure during SCSI scanning
Hung task warnings referencing scsi_remove_host and __wait_for_common in the stack trace
iscsid processes stuck in uninterruptible sleep (D state) during session teardown

Detection Strategies

Monitor dmesg and /var/log/messages for hung task watchdog warnings tied to SCSI teardown paths
Audit running kernel versions against the fixed stable releases referenced in the upstream commits
Correlate stalled iSCSI logout operations with SCSI scan failure log entries

Monitoring Recommendations

Track process state metrics for iscsid and other storage daemons to identify stuck threads
Alert on repeated scsi_alloc_sdev allocation failures, which indicate the precondition for the leak
Capture kernel stack traces for D-state tasks using /proc/<pid>/stack to confirm exposure

How to Mitigate CVE-2026-23296

Immediate Actions Required

Identify hosts running Linux kernels predating the fix commits and prioritize them for patching
Apply distribution-provided kernel updates that include the upstream tagset_refcnt fix
Reboot affected systems after patching, since the fix is in non-swappable kernel code

Patch Information

The issue is resolved by upstream commits to the Linux kernel stable trees. Reference the fixes at Kernel Git Commit 0e27467, Kernel Git Commit 1ac22c8, Kernel Git Commit 7c01b68, Kernel Git Commit 944a333, Kernel Git Commit 9f5e4ab, Kernel Git Commit a03d965, and Kernel Git Commit ec5c17c. Consult your Linux distribution's security advisories for the corresponding packaged kernel version.

Workarounds

Reduce memory pressure during SCSI scanning to lower the probability of scsi_alloc_sdev failures
Avoid initiating iSCSI session teardown on hosts that have logged SCSI allocation failures until a patched kernel is deployed
Schedule controlled reboots to recover hung hosts when teardown has already stalled

bash

# Check running kernel version and confirm presence of the fix
uname -r
grep -r "tagset_refcnt" /usr/src/linux/drivers/scsi/ 2>/dev/null

# Inspect kernel logs for the precondition message
dmesg | grep -i "scsi_alloc_sdev"

# Identify iscsid threads stuck in D state
ps -eo pid,stat,comm | awk '$2 ~ /D/ && $3 == "iscsid"'