CVE-2026-90267: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix specialvec mempool leak when scsiallocsgtables() fails
sdsetspecialbvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables() fails afterward in sdsetupunmapcmnd() or sdsetupwritesame{10,16}cmnd(), the SCSI midlayer does not call uninitcommand() because RQFDONTPREP is not set yet, leaking the page.
Call sduninitcommand() on error, and clear RQFSPECIALPAYLOAD after freeing the page.
Event History
Frequently Asked Questions
What conditions are required for the leak to occur?
A UNMAP or WRITE SAME command must allocate a special payload page, and the subsequent scsi_alloc_sgtables() call must fail. The leak occurs because command cleanup is not invoked at that point.
Which command setup paths are involved?
The affected paths are sd_setup_unmap_cmnd() and sd_setup_write_same10_cmnd() or sd_setup_write_same16_cmnd().