Improper update of reference count in Linux kernel - CVE-2026-99019

Vulnerability details

The vulnerability allows a local privileged user to cause a denial of service by preventing replacement SCSI devices from being accepted and preventing the low-level driver's module from being unloaded.

The vulnerability exists due to missing reference-count decrements in ch_readconfig() in the Linux kernel SCSI changer driver when looking up data transfer devices reported by a changer. A local privileged user can trigger changer initialization and subsequent drive removal to leave unreleased scsi_device references that keep removed devices on the host's device list.

The changer must report its drives' SCSI IDs for the issue to occur.

Affected software

How to mitigate CVE-2026-99019

External References

• https://git.kernel.org/stable/c/1d35a17f1c2ed4154731895694a1a3557f0da766
• https://git.kernel.org/stable/c/27c0f718d3b3c99e6d315308e95d987d0382a8a8
• https://git.kernel.org/stable/c/a34a230ccea1b8b667ae59dca11295a2c8f81738
• https://git.kernel.org/stable/c/cef2cedb6f7a394b278775b3d6ffb9b20ecd61db
• https://git.kernel.org/stable/c/ec6ecab1b7577ae555ee6b81480814d123dd9ec0

Related Security Bulletins

• Improper update of reference count in Linux kernel scsi driver
• Debian update for linux