Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-45997

scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.5, 4.10, 4.15, 4.20, 5.5, and 7 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in 2c2c14b7dfccad8c5a28802849e40c21252e4c28; From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in 262152ec37101f9dc524743ccdbd6c7641d14573; From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in b64b4f499801b12d0e2785447e4df6c164c608a9; From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in 13e550fbfccdb311e76ec96892dfe35f0dba0657; From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in a95d38c5701431bfc826e7b18acc0785919d5c88; From 265dfe8ebbabae7959060bd1c3f75c2473b697ed · fixed in 1e111c4b3a726df1254670a5cc4868cedb946d37; From 4.4.288 · fixed in 4.5; From 4.9.286 · fixed in 4.10; From 4.14.250 · fixed in 4.15; From 4.19.210 · fixed in 4.20; From 5.4.152 · fixed in 5.5; From 5.10.72 · fixed in 5.11; From 5.14.11 · fixed in 5.15

  • Linux Linux

    5.15

  • KernelLinux

    From 5.15.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.86; From 6.13.0 · fixed in 6.18.27; From 6.19.0 · fixed in 7.0.4

References 6

git.kernel.org