Riskcovery

CVE-2026-90267

scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 30, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.

Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before 05bc68669549bfddfdeef2fd119855cab3e9615aAffected
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before 710a2448a06a8215ba8acb4a2791954800f7db0aAffected
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before 744a65e113094756e6c1cfba9ff1bf4247cb68d4Affected
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before e90f746f4ca3896ca560e820b7b6b0a467026938Affected
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before 5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790dAffected
  • 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 to before bb31844d88b77138b67aa20c3600203baff40140Affected
LinuxLinux
  • 4.12Affected
  • before 4.12Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.