CVE-2026-72087 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...

CVE-2026-72081 scsi: elx: efct: Fix I/O leak on unsupported additional CDB

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72270

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct dispatch fcp cmd allocates an efct io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO...

Linux Distros Unpatched Vulnerability : CVE-2026-72087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths...

The vulnerability of the scsi/qla2xxx/qla_gs.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the scsi/qla2xxx/qlags.c component of the Linux operating system is related to the failure to release resources after the expiration of their useful lifespan. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the scsi/qla2xxx/qla_os.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the scsi/qla2xxx/qlaos.c component of the Linux operating system is related to situations where there is a race condition in the signal processing routine. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the hpsa_init_one() function in the drivers/scsi/hpsa.c module of the Linux operating system’s SCSI device driver allows a hacker to cause a service failure.

The vulnerability of the hpsainitone function in the drivers/scsi/hpsa.c module of the Linux SCSI device driver leads to a memory leak. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the __qla2x00_abort_all_cmds() function in the drivers/scsi/qla2xxx/qla_os.c driver of the SCSI device drivers for the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the qla2x00abortallcmds function in the drivers/scsi/qla2xxx/qlaos.c driver for Linux SCSI devices is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: lpfc: Fixed the deadlock issue in the SCSI I/O completion and abort handling routines. During stress I/O tests with 500+ vports, hard lockup calls were observed. CPU A: - nativequeuedspinlockslowpath+0x192 -...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed premature hardware access after a PCI error After a recoverable PCI error is detected and resolved, the qla driver needs to check whether the error condition still exists and/or wait for the operating syst...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed a crash that occurred during module load/unload tests. During purex packet handling, the driver incorrectly freed a pre-allocated structure. This issue was fixed by skipping that specific entry in the code...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive’s capabilities. However, since the driver allocates a fixed 4K buffer for the PRP list, which can accommodate...

CVE-2026-46105

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 5...

CVE-2026-46105

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 5...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: A possible memory leak has been fixed when attempting to issue a CMF WQE. There is no corresponding free routine if lpfcsli4issuewqe fails to issue the CMF WQE in lpfcissuecmfsyncwqe. If retval is non-zero, then free...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use the number of bits to manage bitmap sizes. To allocate bitmaps, the mpi3mr driver calculates the sizes of bitmaps using bytes as the unit. However, bitmap helper functions assume that bitmaps are allocated using...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: megaraidsas: A resource leak has been fixed in case of probe failures. The driver does not properly clean up all allocated resources when the scsiaddhost or megasasstartaen functions fail during the PCI device probe. All...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed null ndlp pointer dereferencing in an abnormal exit path for GFTID An error case resulting from exiting from lpfccmplctcmdgftid causes a call to lpfcnlpput, where a null pointer is used to reference the nodelist...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check kzalloc in lpfcsli4cgnparamsread. If kzalloc fails in lpfcsli4cgnparamsread, then we rely on lpfcreadobject’s routine to perform a NULL check on pdata. Currently, an early return error is thrown from...