CVE-2026-43054

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcm_loop: Drain commands in target_reset handler

tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS

without draining any in-flight commands. The SCSI EH documentation

(scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver

has made lower layers "forget about timed out scmds" and is ready for new

commands. Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug,

mpi3mr) enforces this by draining or completing outstanding commands before

returning SUCCESS.

Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight

scsi_cmnd structures for recovery commands (e.g. TUR) while the target core

still has async completion work queued for the old se_cmd. The memset in

queuecommand zeroes se_lun and lun_ref_active, causing

transport_lun_remove_cmd() to skip its percpu_ref_put(). The leaked LUN

reference prevents transport_clear_lun_ref() from com

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References