PT-2026-27661 · Linux+1 · Linux Kernel+1

Published 2026-01-01 · Updated 2026-05-26 · CVE-2026-23296

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak exists in the SCSI core when tearing down the SCSI host. This leak can lead to a system hang. An example provided shows iscsid hanging with a specific call trace involving scsi alloc sdev and scsi remove host. The issue is related to tagset refcnt.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23296

ECHO-5A69-95EC-C529

Affected Products

Linux Kernel

Iscsid

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23296.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-23296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23296 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23296 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23296 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-50261.html · Vendor Advisory
• https://git.kernel.org/stable/c/0e274674714427dc578bb99db5b86e312d2b57f8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23296 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23296 · Vendor Advisory
• https://git.kernel.org/stable/c/944a333c8e4d42256556c1d2ebb6d773a33e0dcd · Patch
• https://git.kernel.org/stable/c/9f5e4abed9248448aa1b45b12ab0bea4d329b56a · Patch
• https://git.kernel.org/stable/c/ec5c17c687b189dbc09dfdec11b669caa40bc395 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23296 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23296 · Vendor Advisory
• https://git.kernel.org/stable/c/7c01b680beaf4d3143866b062b8e770e8b237fb8 · Patch