CVE-2026-23087: scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen: scsiback: Fix potential memory leak in scsibackremove()
Memory allocated for struct vscsiblkinfo in scsibackprobe() is not freed in scsibackremove() leading to potential memory leaks on remove, as well as in the scsibackprobe() error paths. Fix that by freeing it in scsibackremove().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update/fix the Linux kernel issue titled "scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()" so the memory allocated for struct vscsiblk_info in scsiback_probe() is freed on scsiback_remove() and in scsiback_probe() error paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23087?
The severity of CVE-2026-23087 is classified as medium with a score of 5.5.
What does CVE-2026-23087 affect?
CVE-2026-23087 affects the Linux kernel, specifically the scsiback component related to Xen.
How do I fix CVE-2026-23087?
To fix CVE-2026-23087, ensure that you update your Linux kernel to a version that includes the necessary patches.
What type of vulnerability is CVE-2026-23087?
CVE-2026-23087 is a memory leak vulnerability that occurs in the scsiback_remove() function.
What potential risk does CVE-2026-23087 introduce?
CVE-2026-23087 introduces the risk of memory leaks which can lead to resource exhaustion on systems using the affected components.