CVE-2026-23296: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23296 is a refcount leak vulnerability in the Linux kernel's SCSI core subsystem, specifically in the tagset_refcnt reference counter management. The flaw causes improper resource cleanup during SCSI host teardown, leading to system hangs — most notably observed when iscsid attempts to destroy an iSCSI TCP session. It was published on March 25, 2026, and affects multiple Linux kernel stable branches. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), classified as a local denial-of-service issue (Red Hat CVE, Feedly).

The root cause is classified as CWE-911 (Improper Update of Reference Count): the SCSI core fails to properly decrement the tagset_refcnt reference counter in certain error or teardown paths, leaving the count elevated and preventing the SCSI host from being fully deallocated. The attack vector is local (AV:L) and requires only low privileges (PR:L), with no user interaction needed. When a SCSI device allocation fails during scanning (e.g., scsi_alloc_sdev returns an allocation failure), the leaked refcount causes scsi_remove_host to block indefinitely in __wait_for_common, as seen in the documented call trace involving iscsi_sw_tcp_session_destroy and netlink_sendmsg (Red Hat CVE, Red Hat Bugzilla). Affected kernel versions span multiple stable series, including 5.10.223–5.11, 5.15.164–5.15.203, 5.19.12–6.0, 6.0.1–6.1.167, 6.2–6.6.130, 6.7–6.12.77, 6.13–6.18.17, and 6.19–6.19.7 (Feedly).

Successful exploitation results in a denial-of-service condition where the affected system hangs indefinitely during SCSI host teardown, rendering SCSI-based storage devices inaccessible. There is no impact on confidentiality or integrity (C:N/I:N), but availability is severely affected (A:H) as the hang prevents normal system operation and storage access. Systems using iSCSI (e.g., those running iscsid) are particularly susceptible, as the bug manifests during iSCSI session destruction (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-tenant or shared Linux environments with iSCSI or SCSI device management capabilities.

Patches have been released for all affected stable kernel branches: 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3 (Feedly). Red Hat and Microsoft (Azure Linux 3) have also issued advisories with corresponding package updates (Red Hat CVE, Microsoft MSRC). Amazon Linux 2023 and Debian have published updated kernel packages as well (Amazon ALAS). As a temporary workaround, administrators should minimize unnecessary SCSI device hot-removal operations and avoid frequent iSCSI session disconnections that trigger the vulnerable teardown code path until patching is feasible (Feedly).