CVE-2026-90267scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page. Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 before e90f746f4ca3896ca560e820b7b6b0a467026938; 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 builds before 5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d; from 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 before bb31844d88b77138b67aa20c3600203baff40140 | CNA record |
References
- https://git.kernel.org/stable/c/e90f746f4ca3896ca560e820b7b6b0a467026938
- https://git.kernel.org/stable/c/5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d
- https://git.kernel.org/stable/c/bb31844d88b77138b67aa20c3600203baff40140
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.