{
  "threat_severity" : "Moderate",
  "public_date" : "2026-03-25T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: scsi: core: Fix refcount leak for tagset_refcnt",
    "id" : "2451174",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2451174"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-911",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nscsi: core: Fix refcount leak for tagset_refcnt\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\nPID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: \"iscsid\"\n#0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n#1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n#2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n#3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n#4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n#5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n#6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n#7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n#8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n#9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef", "A flaw was found in the Linux kernel's SCSI core. A reference count leak, a type of resource management issue, occurs when tearing down a SCSI host due to an error in the `tagset_refcnt` mechanism. This can cause the system to hang, leading to a Denial of Service (DoS) for the affected system." ],
  "statement" : "This vulnerability affects systems using iSCSI or other SCSI-based storage where the reference counting error can cause a hang during host teardown. The issue manifests as a process waiting indefinitely in scsi_remove_host(), preventing proper cleanup. Since the impact is limited to availability without any confidentiality or integrity implications, this is rated as Moderate.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23296\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23296\nhttps://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23296-eb4a@gregkh/T" ],
  "name" : "CVE-2026-23296",
  "csaw" : false
}