PatchSiren cyber security CVE debrief

CVE-2026-45997 Linux CVE debrief

A vulnerability in the Linux kernel's SCSI disk (sd) driver could lead to a resource leak when device registration fails. The issue occurs in the error handling path of the SCSI disk probe function: if `device_add()` fails for the disk device, the cleanup code calls `put_device()` which triggers `scsi_disk_release()` to free the `scsi_disk` structure, but the associated `gendisk` structure remains referenced without being released. This leaves the gendisk with an elevated reference count, causing a memory leak. The fix adds a `put_disk()` call in this error path to mirror the cleanup behavior used in the `device_add_disk()` error path within `sd_probe()`. The vulnerability was resolved in the Linux kernel stable branches.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-06-16
Advisory published: 2026-05-27
Advisory updated: 2026-06-16

Who should care

Linux system administrators managing servers with SCSI, SAS, or SATA storage devices; kernel maintainers; organizations running custom kernel builds

Technical summary

The vulnerability exists in `drivers/scsi/sd.c` in the SCSI disk driver probe error handling. When `device_add(&sdkp->disk_dev)` fails, the existing cleanup calls `put_device()` which releases the `scsi_disk` but not the `gendisk`. The fix adds `put_disk(gd)` to properly decrement the gendisk reference count, preventing memory leak. This mirrors the cleanup pattern already present in the `device_add_disk()` error path of `sd_probe()`.

Defensive priority

medium

Recommended defensive actions

Apply kernel updates from your Linux distribution that include the fix for CVE-2026-45997
Verify kernel version includes commits addressing the SCSI sd driver memory leak in the device_add error path
Monitor system memory usage on systems with SCSI/SATA storage devices for potential resource exhaustion indicators
Review kernel changelogs for stable kernel branches to confirm the fix is present

Evidence notes

The CVE description and kernel commit references confirm this is a memory leak fix in the SCSI sd driver error handling path. The fix ensures proper reference counting cleanup when `device_add(&disk_dev)` fails.

Sources and references

Verified primary and authoritative sources

CVE-2026-45997 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-45997

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-45997 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45997

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.