← Back to CVE List
CVE-2026-90268NVD
Vulnerability Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create()
failure must unregister disk_dev and let scsi_disk_release() free
sdkp. Going through out_free_index kfree()s an already registered device
and leaks the sysfs entry.
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create()
failure must unregister disk_dev and let scsi_disk_release() free
sdkp. Going through out_free_index kfree()s an already registered device
and leaks the sysfs entry.
CVSS v3.1 Base Metrics — Score 8.1 (HIGH)
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- Linux Linux >= 7179e626b76eb42f2529c6f6dd6ba88ea2445372 and < 748a14a0d41cfe3017251c11b314f85045414942
- Linux Linux >= 7179e626b76eb42f2529c6f6dd6ba88ea2445372 and < e3cc6ea1a745e7f5d326f919a428b244fa119d8f
- Linux Linux >= 7.1
- Linux Linux 748a14a0d41cfe3017251c11b314f85045414942
- Linux Linux e3cc6ea1a745e7f5d326f919a428b244fa119d8f