CVE-2026-90268
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 7179e626b76eb42f2529c6f6dd6ba88ea2445372 · fixed in 748a14a0d41cfe3017251c11b314f85045414942; From 7179e626b76eb42f2529c6f6dd6ba88ea2445372 · fixed in e3cc6ea1a745e7f5d326f919a428b244fa119d8f
- Linux Linux
7.1
- KernelLinux
From 7.1.0 · fixed in 7.2.6