CVE-2026-72086 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, particularly those using pvSCSI guests, should be aware of this vulnerability and take necessary actions to mitigate it. This includes inventorying affected systems, applying patches, and implementing compensating controls. Security teams should also monitor for potential exploitation attempts and review system logs for suspicious activity. Additionally, operators of affected platforms and vulnerability management teams should prioritize patching and review their security controls to ensure they are adequate to protect against this vulnerability. Those responsible for change management and incident response should also be aware of the potential impact of this vulnerability and have plans in place to respond quickly in case of an exploit. The vulnerability management process should be updated to include checks for this vulnerability, and asset owners should be notified of the potential risk. Security teams should also review their monitoring and detection capabilities to ensure they can detect potential exploitation attempts. The incident response plan should be updated to include procedures for responding to an exploit of this vulnerability. Those responsible for source tracking and vulnerability management should also review their processes to ensure they are adequate to detect and respond to this vulnerability. Compensating controls, such as additional monitoring or restrictions on access, may be necessary for systems that cannot be patched immediately. The vulnerability should be prioritized based on its potential impact and the likelihood of exploitation. Those responsible for Linux kernel-based systems should review their systems for potential exposure and take necessary actions to mitigate the vulnerability. The vulnerability should be addressed through a coordinated effort between system administrators, security teams, and vulnerability management teams. Those responsible for security awareness and training should also be notified of the vulnerability and its potential impact, so they can provide guidance to system administrators and users on how to mitigate it. The patch

Technical summary

The vulnerability is in the scsiback_device_action() function, which obtains a command tag and submits a task-management request. If the submission fails, the function jumps to the err: label, which sends a response but does not free the tag. This can lead to a leak of command tags for a LUN's session. The issue has been resolved by freeing the command tag on the TMR submit-failure path. System administrators and security teams should review the vulnerability and implement necessary mitigations.

Defensive priority

Medium

Recommended defensive actions

• Inventory affected systems and apply the patch
• Monitor for potential exploitation attempts
• Implement compensating controls to mitigate the vulnerability
• Review system logs for suspicious activity
• Verify patch deployment and system security
• Update incident response plans to include procedures for responding to an exploit
• Notify asset owners of the potential risk and necessary actions

Evidence notes

The vulnerability is caused by a failure to free the command tag when a task-management request submission fails. The issue is in the scsiback_device_action() function, which obtains a command tag and submits a task-management request. If the submission fails, the function jumps to the err: label, which sends a response but does not free the tag. This can lead to a leak of command tags for a LUN's session.

Official resources