CVE-2026-90268 scsi: sd: Fix error handling in sd_probe() after large pool creation failure

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90268 scsi: sd: Fix error handling in sd_probe() after large pool creation failure

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

CVE-2026-90267

CVE-2026-90267 affects the Linux kernel SCSI disk driver (scsi: sd). The vulnerability is a mempool leak of the special_vec page used for UNMAP and WRITE SAME commands. When sd_set_special_bvec() allocates the payload page and a subsequent call to scsi_alloc_sgtables() fails (in sd_setup_unmap_cm...

EUVD-2026-81860

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

PT-2026-94615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SCSI subsystem when scsi alloc sgtables fails. The function sd set special bvec allocates a special payload page for UNMAP and WRITE SAME commands. If a...

PT-2026-94788

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCSI UFS core where string descriptors are not properly validated. The utf16s to utf8s function expects a count of UTF-16 code units rather than bytes. Because the...

PT-2026-94633

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the scsi qla2xxx driver, the qla2x00 sysfs read vpd function performs a redundant call to ha-isp ops-read optrom. This second call occurs after the optrom mutex has been released, whi...

PT-2026-94616

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An error handling issue exists in the sd probe function within the SCSI subsystem. When sd large pool create fails after device add&sdkp-disk dev has already succeeded, the system fails ...

PT-2026-94498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Device leaks occur during parse failures within the pnfs/blocklayout component. The functions bl parse concat and bl parse stripe allocate a child device array and parse each child...

CVE-2026-93057: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr, ufshcdtxeqtr and ufsqcomgetrxfom allocate...

CVE-2026-92480: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

CVE-2026-92479: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...

CVE-2026-92478: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-92477: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufssavederrwrite copies user input into a zero-initialized stack buffer and passes it to kstrtoint. A write that fills the entire buffer overwrites its only terminator...

CVE-2026-90268: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90267: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

CVE-2026-90202: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

PT-2026-94786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi ufs core where connected lane counts are not properly validated. These counts are used by the TX equalization code to index arrays sized by UFS MAX LANES...

CVE-2026-89854

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown it ran before scsiremovehost, which is...