Vulnerability · CVE-2026-99207
CVE-2026-99207: scsi: target: Disable interrupts while holding delayed_cmd_lock
Published Oct 28, 2026 · catalog updated Oct 29, 2026 · Linux Linux
Last checked Nov 4, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-99207. EPSS is 0.14%. Act only if a listed version of Linux Linux is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-99260 · Medium
- CVE-2026-99259 · Medium
- CVE-2026-99258 · High
- CVE-2026-99257 · Medium
- CVE-2026-99255 · Medium
- Severity
- High—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.14%
- Remediation
- Advisory link
- Affected products
- Linux Kernel · linux kernel · vendor Linux Linux
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_complete_ordered_sync() in target_core_transport.c, and target_non_ordered_release() in target_core_device.c. That was safe while every caller of transport_complete_task_attr() ran in process context: target_complete_ok_work() from target_completion_wq, transport_complete_qf() from dev->qf_work_queue, and transport_generic_request_failure() from the submit and execute paths. Since commit 06933066d88a ("scsi: target: Add support for completing commands from backend context") that is no longer true. With complete_type=1 on a fabric that sets direct_compl_supp, target_complete() runs target_complete_ok_work() inline in the backend's completion context, which target_complete_cmd_with_sense() documents as "May be called from interrupt context". For iblock that is the bio end_io. target_complete_ok_work() starts with transport_complete_task_attr(), which takes delayed_cmd_lock in two ways: - Every ORDERED command is put on dev->delayed_cmd_list by target_handle_task_attr() and dispatched from there by target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its completion therefore goes through transport_complete_ordered_sync(). - A SIMPLE command that completes while an ORDERED command is pending drops the last reference to the killed dev->non_ordered, and percpu_ref_put() then runs target_non_ordered_release() in the completing context. Both take the lock and, if commands are waiting, call schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq, i.e. on the CPU that took the completion. Further completions for the same queue are typically delivered there too,
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Linux Kernel7.1.0 → 7.2.13
- linux kernelversion unspecified
- vendor Linux Linuxversion unspecified
How to fix CVE-2026-99207
Upgrade
CVE-2026-99207 lists a fix boundary at 7.2.13. Compare the installed build with that boundary before you change production.
Version check
Seen in 7.1.0 → 7.2.13
Advisory
Open the bsi record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-99207. EPSS is 0.14%. Act only if a listed version of Linux Linux is installed.
Which versions are affected?
Compare what you have installed with Kernel 7.1.0 → 7.2.13. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · Tenable CVE Database
Detected
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_comp
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 7.2.13
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 7.2.13
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_comp
Sources
- BSI CERT-BundGovernment advisoryCVE-2026-99207
Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
wid.cert-bund.de - CVE.orgVulnerability recordCVE-2026-99207
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the l
cve.org - FIRST EPSSExploitation probabilityCVE-2026-99207
30-day exploitation probability 0.14%
first.org - Linux Kernel CVEVendor advisoryCVE-2026-99207
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_
git.kernel.org - OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99207
scsi: target: Disable interrupts while holding delayed_cmd_lock
osv.dev - Tenable CVE DatabaseVulnerability recordCVE-2026-99207
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_comp
tenable.com
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 4, 2026
- BSI CERT-BundOct 30, 2026
- CVE.orgOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 29, 2026
- Linux Kernel CVEOct 28, 2026
- Tenable CVE DatabaseOct 28, 2026