Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99019— scsi: ch: Do not keep references to data transfer element devices

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： SCSI 子系统（ch 驱动）：不再保留对数据传输单元设备的引用 函数会根据磁带库（changer）在 命令中报告的数据传输单元（data transfer element）的 SCSI ID，查找对应的 结构体，并将其存储在 数组中。 会获取一个引用计数，但后续没有任何代码释放该引用： 仅通过 释放了数组本身，而 在其他地方并未被读取，其唯一用途是在同一循环中打印厂商、型号和版本信息。 一旦此类驱动器被移除，其对应的 结构体将永远无法被释放。该设备会一直保留在主机设备

AI Predicted 5.5 Difficulty: Moderate EPSS 0.18% · P7

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux daa6eda65a53e5addf86c6bc829129ff51b08bda< ec6ecab1b7577ae555ee6b81480814d123dd9ec0 affected
daa6eda65a53e5addf86c6bc829129ff51b08bda< cef2cedb6f7a394b278775b3d6ffb9b20ecd61db affected
daa6eda65a53e5addf86c6bc829129ff51b08bda< a34a230ccea1b8b667ae59dca11295a2c8f81738 affected
daa6eda65a53e5addf86c6bc829129ff51b08bda< 1d35a17f1c2ed4154731895694a1a3557f0da766 affected
daa6eda65a53e5addf86c6bc829129ff51b08bda< 27c0f718d3b3c99e6d315308e95d987d0382a8a8 affected
2.6.13 affected
< 2.6.13 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99019

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
scsi: ch: Do not keep references to data transfer element devices
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux daa6eda65a53e5addf86c6bc829129ff51b08bda ~ ec6ecab1b7577ae555ee6b81480814d123dd9ec0 -
Linux Linux 2.6.13 -

II. Public POCs for CVE-2026-99019

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99019

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99019 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99018 7.8 HIGH riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99032 7.8 HIGH net/smc: protect clcsock lifetime in smc_getname
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux