PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45872 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's smartpqi SCSI driver. The function pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when allocation for rpl_16byte_wwid_list fails. These early return paths bypass cleanup logic, causing memory leaks. The fix consolidates error handling by adding an out_free_rpl_list label and using goto statements to ensure rpl_list is consistently freed on failure. The vulnerability was identified through a prototype static analysis tool and code review, with the fix compile-tested only.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators managing Linux servers with Microsemi/Adaptec Smart Family SCSI/SAS controllers; kernel maintainers and distribution security teams responsible for backporting stable kernel fixes.

Technical summary

The smartpqi driver in the Linux kernel contains a memory leak in the pqi_report_phys_luns() function. When the function encounters an unsupported data format or fails to allocate rpl_16byte_wwid_list, it returns early without freeing the previously allocated rpl_list buffer. The resolution introduces a centralized cleanup label (out_free_rpl_list) and goto-based error handling to ensure consistent memory deallocation across all failure paths. This is a defensive coding fix with no evidence of active exploitation.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor vendor security advisories for smartpqi driver updates
  • Consider disabling unused SCSI HBA drivers if smartpqi hardware is not present
  • Review systems using Microsemi/Adaptec Smart Family controllers for kernel update prioritization

Evidence notes

The CVE description indicates this issue was found using a prototype static analysis tool and code review, with compile testing only. The fix involves consolidating error handling in pqi_report_phys_luns() to ensure proper memory deallocation on failure paths. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Official resources

2026-05-27