PT-2026-36471 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-03 · CVE-2026-43054

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The tcm loop target reset() function violates the SCSI Error Handler (EH) contract by returning success without draining in-flight commands. This allows the SCSI EH to reuse scsi cmnd structures for recovery commands while the target core still has asynchronous completion work queued for the old se cmd. Consequently, the memset in queuecommand zeroes se lun and lun ref active, leading transport lun remove cmd() to skip its percpu ref put(). This results in a leaked LUN reference that prevents transport clear lun ref() from completing, causing the configfs LUN unlink process to hang indefinitely in D-state.

Recommendations Update the Linux kernel to a version where tcm loop target reset() is modified to drain commands by issuing TMR LUN RESET via tcm loop issue tmr() and using blk mq tagset busy iter() to iterate started requests and apply flush work() on each se cmd.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-43054

ECHO-2BD4-D041-E7B1

Affected Products

Linux Kernel

References · 17

• https://cve.org/CVERecord?id=CVE-2026-43054 · Security Note
• https://git.kernel.org/stable/c/1333eee56cdf3f0cf67c6ab4114c2c9e0a952026 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43054 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43054 · Vendor Advisory
• https://git.kernel.org/stable/c/a836054ea81014117ec6b73529a21626a9e1f829 · Patch
• https://ubuntu.com/security/CVE-2026-43054 · Vendor Advisory
• https://git.kernel.org/stable/c/7cbd69aaa507b1245240a28022bf5da0f07c68d9 · Patch
• https://git.kernel.org/stable/c/757c43c692294cdfad31390accc0e90429b2ef8a · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43054 · Vendor Advisory
• https://git.kernel.org/stable/c/103f79e4949513247d763c6e7f3cbbf62017afdf · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43054 · Vendor Advisory
• https://git.kernel.org/stable/c/05ac3754467363558a0a54ae4bb7c89b2c9574cf · Patch
• https://git.kernel.org/stable/c/15f5241d5a52364a7e7867b49128b0442dbcad9d · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43054 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-43054 · Note