Linux kernel: Use-after-free race between SCSI tape removal and open
Summary
A race condition in the Linux kernel SCSI tape driver (st) allows a use-after-free when a tape device is removed while an open operation is in progress. A local attacker with access to a tape device node could potentially crash the system or manipulate kernel memory. The issue requires a SCSI tape device and a local open during device removal.
Affected
- Linux kernel from commit 6c648d95 (introduced in 3.7) until the respective fixed stable versions
- Fixed stable branches: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13
- Affected version ranges per the CNA record and OSV; exact ranges should be verified against the kernel.org commits
Fixed in
- Stable kernel commits: 00ff1128, 18a0e373, 5ef230f7, 71caf7f8, 7d7f9d2e, a1647b65, d9517fc3, e7a5da4a
- Stable versions: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13 or later
- Use your distribution's kernel update for the exact fixed build
Workaround
- Unknown.
- Limit local shell access and prevent untrusted users from reaching tape device nodes until patched.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Apply the vendor kernel update through the normal update cycle; prioritise hosts with tape hardware or multiple local users.
- Check whether backup servers use SCSI tape drives.
- Restrict local access to shared systems and monitor kernel logs for crashes related to the st driver.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubuntu security: CVE-2026-99156 ubuntu.com
- VulDB: CVE-2026-99156 vuldb.com
- Kernel stable commit 18a0e373 git.kernel.org
- Kernel stable commit a1647b65 git.kernel.org
- Kernel stable commit 71caf7f8 git.kernel.org
- OSV Alpaquita BELL-CVE-2026-99156 osv.dev
- Debian CVE tracker mirror (Vulners) vulners.com
- OffSeq radar CVE-2026-99156 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:02.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put().
NVD references (8)
- https://git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648
- https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5
- https://git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084
- https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f
- https://git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de
- https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822
- https://git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c
- https://git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.