Linux Distros Unpatched Vulnerability : CVE-2026-72087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths...

The vulnerability of the scsi/qla2xxx/qla_gs.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the scsi/qla2xxx/qlags.c component of the Linux operating system is related to the failure to release resources after the expiration of their useful lifespan. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the scsi/qla2xxx/qla_os.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the scsi/qla2xxx/qlaos.c component of the Linux operating system is related to situations where there is a race condition in the signal processing routine. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the hpsa_init_one() function in the drivers/scsi/hpsa.c module of the Linux operating system’s SCSI device driver allows a hacker to cause a service failure.

The vulnerability of the hpsainitone function in the drivers/scsi/hpsa.c module of the Linux SCSI device driver leads to a memory leak. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the __qla2x00_abort_all_cmds() function in the drivers/scsi/qla2xxx/qla_os.c driver of the SCSI device drivers for the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the qla2x00abortallcmds function in the drivers/scsi/qla2xxx/qlaos.c driver for Linux SCSI devices is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive’s capabilities. However, since the driver allocates a fixed 4K buffer for the PRP list, which can accommodate...

CVE-2026-46105

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 5...

CVE-2026-46105

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 5...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use the number of bits to manage bitmap sizes. To allocate bitmaps, the mpi3mr driver calculates the sizes of bitmaps using bytes as the unit. However, bitmap helper functions assume that bitmaps are allocated using...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fixed the sashba.phy memory leak in mpi3mrremove Released mrioc-sashba.phy at .remove...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed null ndlp pointer dereferencing in an abnormal exit path for GFTID An error case resulting from exiting from lpfccmplctcmdgftid causes a call to lpfcnlpput, where a null pointer is used to reference the nodelist...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Fixed a crash in fnicwqcmplhandler when FDMI times out. When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. Upon completion of the sending process, this leads to a...

CVE-2026-43473

A flaw was found in the Linux kernel's mpi3mr SCSI driver. When the creation of reply or request queues fails, the driver may attempt to access and modify memory that has already been freed during cleanup. This can be exploited by a local user, leading to a system crash and a Denial of Service Do...

EUVD-2026-28720

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xxelsdcmdiocb sp-free is set to qla2x00elsdcmdspfree. When an error happens, this function is called by qla2x00sprelease, when krefput releases the first and the last...

UBUNTU-CVE-2026-43414

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xxelsdcmdiocb sp-free is set to qla2x00elsdcmdspfree. When an error happens, this function is called by qla2x00sprelease, when krefput releases the first and the last...

UBUNTU-CVE-2026-43413

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Fix NULL pointer exception during userscan userscan invokes updated sasuserscan for channel 0, and if successful, iteratively scans remaining channels 1 to shost-maxchannel via scsiscanhostselected in commit...

CVE-2026-43473 scsi: mpi3mr: Add NULL checks when resetting request and reply queues

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Add NULL checks when resetting request and reply queues The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation o...

CVE-2026-43414

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xxelsdcmdiocb sp-free is set to qla2x00elsdcmdspfree. When an error happens, this function is called by qla2x00sprelease, when krefput releases the first and the last...

CLSA-2026-1777636990 Fix of 9 CVEs

CVE-2026-31431 - crypto: scatterwalk - Backport memcpysglist CVE-2026-31431 - crypto: algifaead - use memcpysglist instead of null skcipher CVE-2026-31431 - crypto: algifaead - Revert to operating out-of-place CVE-2026-31431 - crypto: algifaead - snapshot IV for async AEAD requests CVE-2026-31431...

The vulnerability of the iscsi_sw_tcp_conn_set_param() function in the drivers/scsi/iscsi_tcp.c file of the Linux operating system’s SCSI device driver allows a attacker to cause a service failure.

The vulnerability of the iscsiswtcpconnsetparam function in the drivers/scsi/iscsitcp.c file of the Linux SCSI device driver is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...