Linux xen-scsiback: guest can underflow a command refcount and exhaust a LUN's command tags

Impact

scsiback_get_pend_req() hands back a vscsibk_pend whose embedded se_cmd has a zeroed cmd_kref, initialised only later on the successful CDB path. Two error paths taken before submission - a failed grant mapping and an unknown request type - call transport_generic_free_cmd() and kref_put() a refcount of zero, underflowing it and leaking the command tag because the release function never runs. The practical impact as stated upstream: a pvSCSI guest can leak every command tag of a LUN's session by submitting requests with a bad grant reference or an unknown request type, stopping that LUN; with panic_on_warn set the underflow panics the host. This only matters to Xen hosts that export pvSCSI LUNs to guests - a narrow configuration, absent on KVM fleets - but where it is used a single tenant VM can deny storage to others or take the host down.

Who can reach it

Local - a Xen guest with a pvSCSI (vscsi) device attached, using only its own ring. Requires the host to run the xen-scsiback backend; no host credentials needed.

What to do

Apply the stable kernel fix (five backport commits listed) and reboot affected Xen hosts after migrating or shutting down guests. Interim mitigations: do not export pvSCSI LUNs to untrusted guests, and clear panic_on_warn on Xen storage hosts so the refcount underflow degrades to a warning rather than a host panic. No fixed distro version is given in the record.

References

Related entries

• Linux KVM arm64 vgic: use-after-free racing LPI disable against interrupt affinity changeCVE-2026-72288 · Linux kernel KVM arm64 vgic (LPI disable vs affinity change race)Critical
• Linux KVM arm64 vgic: double list_del when an LPI leaves the ap_list during migrationCVE-2026-72289 · Linux kernel KVM arm64 vgic (ap_list ownership check before LPI migration)Critical
• Linux vhost/net: use-after-free when a cloned zerocopy skb completes after backend resetCVE-2026-74310 · Linux kernel vhost/net (zerocopy ubuf_info completion)Critical
• Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still setCVE-2026-74439 · Linux kernel (drivers/iommu/intel)Critical
• Linux kernel (arch/x86/kvm): The I/O APIC's delayed EOI work was cancelled only after vCPUs were freed, so the workCVE-2026-74517 · Linux kernel (arch/x86/kvm)Critical
• Linux KVM arm64 vgic: LPI release races re-registration, erasing or leaking the xarray entryCVE-2026-74568 · Linux kernel KVM arm64 vgic (LPI release vs re-registration in dist->lpi_xa)Critical