CVE-2026-72086: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-mxg2-v7p6-pg5g
Share
Published
Advisory Summary

CVE-2026-72086 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72086 at a Glance

CVE Identifier CVE-2026-72086
GHSA Identifier GHSA-mxg2-v7p6-pg5g
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-72086

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72086, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsiback_device_action() obtains a command tag in scsiback_get_pend_req() and submits a task-management request with target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and scsiback jumps to the err: label, which sends a response but frees nothing, leaking the tag. Impact: a pvSCSI guest can leak the command tags of a LUN's session, stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests whenever target_submit_tmr() fails. transport_generic_free_cmd() cannot be used here. By the time target_submit_tmr() returns an error it has already run __target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the pointer dangling. Letting the command release run target_free_cmd_mem() would then double-free se_tmr_req. Use the same helper, which returns just the tag, on this path too.

References

NVD — CVE-2026-72086 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72086
git.kernel.org/stable/c/1357fb32d4... WEB
https://git.kernel.org/stable/c/1357fb32d42ad8da193e6da285f09e6452feabda
git.kernel.org/stable/c/18d4f86816... WEB
https://git.kernel.org/stable/c/18d4f86816592586b38513543b5e1f9553bc271f
git.kernel.org/stable/c/255fb7b0cd... WEB
https://git.kernel.org/stable/c/255fb7b0cdc947b1c01929c7f133281342a3a6b5
git.kernel.org/stable/c/4567ce79fe... WEB
https://git.kernel.org/stable/c/4567ce79fe2f84c3dcc3a91b22a377cf482d33ad
git.kernel.org/stable/c/66aefc277e... WEB
https://git.kernel.org/stable/c/66aefc277ebb796ec285d550305535dc3fc0179f
git.kernel.org/stable/c/6c01f04390... WEB
https://git.kernel.org/stable/c/6c01f0439098f00a64b246dc27479602201382f7
git.kernel.org/stable/c/fbc1bdede6... WEB
https://git.kernel.org/stable/c/fbc1bdede66d0f2cde83b75d6524ce1a815bb69f

Frequently Asked Questions

What is CVE-2026-72086?
CVE-2026-72086 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72086?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-72086?
CVE-2026-72086 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72086?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mxg2-v7p6-pg5g",
  "modified" : "2026-08-15T06:32:11Z",
  "published" : "2026-08-15T06:32:11Z",
  "aliases" : [ "CVE-2026-72086" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen: scsiback: Free the command tag on the TMR submit-failure path\n\nscsiback_device_action() obtains a command tag in\nscsiback_get_pend_req() and submits a task-management request with\ntarget_submit_tmr(). When target_submit_tmr() fails it returns < 0 and\nscsiback jumps to the err: label, which sends a response but frees\nnothing, leaking the tag.\n\nImpact: a pvSCSI guest can leak the command tags of a LUN's session,\nstopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests\nwhenever target_submit_tmr() fails.\n\ntransport_generic_free_cmd() cannot be used here. By the time\ntarget_submit_tmr() returns an error it has already run\n__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its\ntarget_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via\ncore_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the\npointer dangling. Letting the command release run target_free_cmd_mem()\nwould then double-free se_tmr_req.\n\nUse the same helper, which returns just the tag, on this path too.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72086"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1357fb32d42ad8da193e6da285f09e6452feabda"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/18d4f86816592586b38513543b5e1f9553bc271f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/255fb7b0cdc947b1c01929c7f133281342a3a6b5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4567ce79fe2f84c3dcc3a91b22a377cf482d33ad"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/66aefc277ebb796ec285d550305535dc3fc0179f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6c01f0439098f00a64b246dc27479602201382f7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fbc1bdede66d0f2cde83b75d6524ce1a815bb69f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:22Z"
  }
}