{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99156 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99156 is a vulnerability in Linux, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99156 and fix it if it is affected.\n\nWhat it is: CVE-2026-99156 is a vulnerability in Linux, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99156 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99156/ (Markdown: https://insights.sbomify.com/CVE-2026-99156/index.md)","id":"CVE-2026-99156","markdown":"https://insights.sbomify.com/CVE-2026-99156/index.md","name":"CVE-2026-99156","record":{"aliases":["AZL-111296","BELL-CVE-2026-99156","DEBIAN-CVE-2026-99156","GHSA-3wp3-5585-mc8q","UBUNTU-CVE-2026-99156"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n  BUG: KASAN: slab-use-after-free in st_open\n  Write of size 4 ...\n   st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n   chrdev_open\n  ...\n  Freed by task ...:\n   kfree\n   st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"scsi: st: Fix use-after-free race between st_remove() and st_open()","id":"CVE-2026-99156","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies","id":"CVE-2026-99157"},"packages":[],"prev":{"headline":"scsi: xen/scsifront: Check for a NULL shadow entry on a backend response","id":"CVE-2026-99155"},"products":["Linux"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99156/"}