Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.
Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < 05bc68669549bfddfdeef2fd119855cab3e9615a; >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < 710a2448a06a8215ba8acb4a2791954800f7db0a; >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < 744a65e113094756e6c1cfba9ff1bf4247cb68d4; >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < e90f746f4ca3896ca560e820b7b6b0a467026938; >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < 5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d; >= 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87, < bb31844d88b77138b67aa20c3600203baff40140 |
| Linux | Linux | 4.12 |
References
- https://git.kernel.org/stable/c/05bc68669549bfddfdeef2fd119855cab3e9615a
- https://git.kernel.org/stable/c/5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d
- https://git.kernel.org/stable/c/710a2448a06a8215ba8acb4a2791954800f7db0a
- https://git.kernel.org/stable/c/744a65e113094756e6c1cfba9ff1bf4247cb68d4
- https://git.kernel.org/stable/c/bb31844d88b77138b67aa20c3600203baff40140
- https://git.kernel.org/stable/c/e90f746f4ca3896ca560e820b7b6b0a467026938
Timeline
- Published
- Sep 17, 2026
- Last modified
- Oct 30, 2026
- NVD status
- Received