# CVE-2026-72085: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

> A malicious guest can cause a use-after-free and tag leak in the Xen SCSI backend, leading to LUN denial of service or host panic.

- **Severity:** Critical 9.3 (`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-72085, DEBIAN-CVE-2026-72085, GHSA-vprc-jrmr-xq56, UBUNTU-CVE-2026-72085

## What is CVE-2026-72085?

CVE-2026-72085 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the se_cmd is initialised (kref_init() via target_init_cmd()) only
later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB
path. The two error paths in scsiback_do_cmd_fn() taken before the
command is submitted -- a failed scsiback_gnttab_data_map() and an
unknown ring_req.act -- call
transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a
refcount of 0. That underflows it ("refcount_t: underflow;
use-after-free") and, as the release function is not run, leaks the
command tag.

Impact: a pvSCSI guest can leak every command tag of a LUN's session,
stopping the LUN, by submitting requests with a bad grant reference or
an unknown request type; under panic_on_warn the refcount underflow
panics the host.

Add a helper that just returns the tag with target_free_tag() and sends
the error response. It frees the tag while the v2p reference still pins
the session, and snapshots the response fields beforehand because
freeing the tag can let another ring reuse the pending_req slot.

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-72085?


## How do I fix CVE-2026-72085?

Apply the vendor's patch.

## Is CVE-2026-72085 being exploited?

There is no known exploitation of CVE-2026-72085 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-72085 and fix it if it is affected.

What it is: CVE-2026-72085 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-72085 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-72085/ (Markdown: https://insights.sbomify.com/CVE-2026-72085/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72085
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72085
- OSV: https://osv.dev/vulnerability/CVE-2026-72085

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-72085/
Summaries are generated and may contain mistakes; the official description above is the record.