UBUNTU-CVE-2026-90267: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables() fails sdsetspecialbvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables() fails afterward in sdsetupunmapcmnd() or sdsetupwritesame{10,16}cmnd(), the SCSI midlayer does not call uninitcommand() because RQFDONTPREP is not set yet, leaking the page. Call sduninitcommand() on error, and clear RQFSPECIALPAYLOAD after freeing the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the SCSI sd error path, call sd_uninit_command() when scsi_alloc_sgtables() fails in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), and clear RQF_SPECIAL_PAYLOAD after freeing the special payload page.
Event History
Frequently Asked Questions
Which systems are affected?
The issue applies to Ubuntu Linux kernel packages listed as ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, and ubuntu/linux-oracle.
What conditions are needed to trigger the leak?
A SCSI UNMAP or WRITE SAME command must allocate a special payload page, followed by failure of scsi_alloc_sgtables() while preparing that command. Under those conditions, the allocated page is not released.
What is the impact of successful triggering?
Successful triggering leaks a special payload page from the mempool. The provided information describes a resource leak and does not state any other impact.