CVE-2026-45997
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.
INFO
Published Date :
May 27, 2026, 2:17 p.m.
Last Modified :
June 17, 2026, 10:52 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel.
- Ensure scsi sd driver includes the put_disk() fix.
- Review scsi disk device handling logic.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-45997.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-45997 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-45997
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-45997 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-45997 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': '2c2c14b7dfccad8c5a28802849e40c21252e4c28', 'versionType': 'git'}, {'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': '262152ec37101f9dc524743ccdbd6c7641d14573', 'versionType': 'git'}, {'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': 'b64b4f499801b12d0e2785447e4df6c164c608a9', 'versionType': 'git'}, {'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': '13e550fbfccdb311e76ec96892dfe35f0dba0657', 'versionType': 'git'}, {'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': 'a95d38c5701431bfc826e7b18acc0785919d5c88', 'versionType': 'git'}, {'status': 'affected', 'version': '265dfe8ebbabae7959060bd1c3f75c2473b697ed', 'lessThan': '1e111c4b3a726df1254670a5cc4868cedb946d37', 'versionType': 'git'}, {'status': 'affected', 'version': 'd56459d361a9a99bead8b594635353053271356c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3e5a9208466b63f27a2509a691023b446ea5105', 'versionType': 'git'}, {'status': 'affected', 'version': '4e8e6427319de323f613caa8fd37120df83138d0', 'versionType': 'git'}, {'status': 'affected', 'version': 'eadb60bcc2005247d97dcb3becee57aba4024ff4', 'versionType': 'git'}, {'status': 'affected', 'version': '350d048cc506368a316f0bc4082426b24a2a9fc0', 'versionType': 'git'}, {'status': 'affected', 'version': '60df9f55562a57173a11b6c7011eee40dfa48157', 'versionType': 'git'}, {'status': 'affected', 'version': 'e95f62013a1159eeea752bb52df0683ee77f70ca', 'versionType': 'git'}, {'status': 'affected', 'version': '4.4.288', 'lessThan': '4.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.9.286', 'lessThan': '4.10', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.14.250', 'lessThan': '4.15', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.210', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.152', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.10.72', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.14.11', 'lessThan': '5.15', 'versionType': 'semver'}], 'programFiles': ['drivers/scsi/sd.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.27', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.4', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/scsi/sd.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.14.11 up to (excluding) 5.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.86 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.27 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.14.250 up to (excluding) 4.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.210 up to (excluding) 4.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.4.288 up to (excluding) 4.5 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.9.286 up to (excluding) 4.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.72 up to (excluding) 5.11 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.1 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.152 up to (excluding) 5.5 Added Reference Type kernel.org: https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2c2c14b7dfccad8c5a28802849e40c21252e4c28 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 01, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/2c2c14b7dfccad8c5a28802849e40c21252e4c28 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 27, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup. Added Reference https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657 Added Reference https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37 Added Reference https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573 Added Reference https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88 Added Reference https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9