SB20261023148 - Improper update of reference count in Linux kernel scsi driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023148

SB20261023148 - Improper update of reference count in Linux kernel scsi driver

Published: October 23, 2026

Security Bulletin ID SB20261023148
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper update of reference count (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause a denial of service by preventing replacement SCSI devices from being accepted and preventing the low-level driver's module from being unloaded.

The vulnerability exists due to missing reference-count decrements in ch_readconfig() in the Linux kernel SCSI changer driver when looking up data transfer devices reported by a changer. A local privileged user can trigger changer initialization and subsequent drive removal to leave unreleased scsi_device references that keep removed devices on the host's device list.

The changer must report its drives' SCSI IDs for the issue to occur.


Remediation

Install update from vendor's website.

References