CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
Published May 27, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: fix missing putdisk() when deviceadd(&diskdev) fails
If deviceadd(&sdkp->diskdev) fails, putdevice() runs scsidiskrelease(), which frees the scsidisk but leaves the gendisk referenced. The deviceadddisk() error path in sdprobe() calls putdisk(gd); call putdisk(gd) here to mirror that cleanup.
Affected Software
20 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=4.4.288<4.5
Linux Linux kernel>=4.9.286<4.10
Linux Linux kernel>=4.14.250<4.15
Linux Linux kernel>=4.19.210<4.20
Linux Linux kernel>=5.4.152<5.5
Linux Linux kernel>=5.10.72<5.11
Linux Linux kernel>=5.14.11<5.15
Linux Linux kernel>=5.15.1<6.1.175
Linux Linux kernel>=6.2<6.6.140
Linux Linux kernel>=6.7<6.12.86
Linux Linux kernel>=6.13<6.18.27
Linux Linux kernel>=6.19<7.0.4
Linux Linux kernel=5.15
Linux Linux kernel=5.15-rc3
Linux Linux kernel=5.15-rc4
Linux Linux kernel=5.15-rc5
Linux Linux kernel=5.15-rc6
Linux Linux kernel=5.15-rc7
Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1
6.6.141.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
May 27, 2026
CVE Published
via MITRE·12:55 PM
Data Sourced
via MITRE·12:55 PM
Description
Data Sourced
via NVD·02:17 PM
RemedyDescriptionSeverityAffected Software
May 28, 2026
Data Sourced
via Microsoft·08:07 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:07 AM
Affected Software
Updated
via Microsoft·08:07 AM
DescriptionSeverity