CVE-2026-45997

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < 2c2c14b7dfccad8c5a28802849e40c21252e4c28; >= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < 262152ec37101f9dc524743ccdbd6c7641d14573; >= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < b64b4f499801b12d0e2785447e4df6c164c608a9; >= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < 13e550fbfccdb311e76ec96892dfe35f0dba0657; >= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < a95d38c5701431bfc826e7b18acc0785919d5c88; >= 265dfe8ebbabae7959060bd1c3f75c2473b697ed, < 1e111c4b3a726df1254670a5cc4868cedb946d37; d56459d361a9a99bead8b594635353053271356c; a3e5a9208466b63f27a2509a691023b446ea5105; 4e8e6427319de323f613caa8fd37120df83138d0; eadb60bcc2005247d97dcb3becee57aba4024ff4; 350d048cc506368a316f0bc4082426b24a2a9fc0; 60df9f55562a57173a11b6c7011eee40dfa48157; e95f62013a1159eeea752bb52df0683ee77f70ca; >= 4.4.288, < 4.5; >= 4.9.286, < 4.10; >= 4.14.250, < 4.15; >= 4.19.210, < 4.20; >= 5.4.152, < 5.5; >= 5.10.72, < 5.11; >= 5.14.11, < 5.15
LinuxLinux5.15
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
May 27, 2026
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-459987.8In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() CVE-2026-459997.1In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some craCVE-2026-46009.1Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameCVE-2026-460005.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix conn-level packet handling to unshare RESPONSE packets The CVE-2026-460017.8In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs inCVE-2026-460025.5In the Linux kernel, the following vulnerability has been resolved: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() exCVE-2026-460035.5In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameservCVE-2026-460047.8In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setupCVE-2026-460055.5In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfs_alloc_buftarg() In the error path, calCVE-2026-460067.8In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_geCVE-2026-460075.5In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on thCVE-2026-460084.7In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond
CVE-2026-45997: Medium severity, CVSS 5.5 | Vulnix