CVE-2026-90268: scsi: sd: Fix error handling in sd_probe() after large pool creation failure

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd: Fix error handling in sdprobe() after large pool creation failure

After deviceadd(&sdkp->diskdev) succeeds, sdlargepoolcreate() failure must unregister diskdev and let scsidiskrelease() free sdkp. Going through outfreeindex kfree()s an already registered device and leaks the sysfs entry.

Event History

Sep 17, 2026

CVE Published

via MITRE·04:08 PM

Data Sourced

via MITRE·04:08 PM

Description

Frequently Asked Questions

Under what conditions does the vulnerable error path occur?

It occurs during SCSI disk probing when device_add(&sdkp->disk_dev) has already succeeded and sd_large_pool_create() subsequently fails.

What observable impact can indicate that this path was taken?

The faulty cleanup can leave a leaked sysfs entry because an already registered device is freed through the wrong error path.

CVE-2026-90268: scsi: sd: Fix error handling in sd_probe() after large pool creation failure

Event History

Frequently Asked Questions

Under what conditions does the vulnerable error path occur?

What observable impact can indicate that this path was taken?

Company

Resources

Contact

Frequently Asked Questions

Under what conditions does the vulnerable error path occur?

What observable impact can indicate that this path was taken?