HIGH Introduced in 7.1
scsi LargePool UAF
CVE-2026-90268
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the SCSI disk driver's error handling path when a device with sector size larger than the page size is attached and memory pool creation fails. An attacker with physical access could attach a crafted SCSI device and exploit memory pressure to trigger the bug, potentially leading to kernel code execution or denial of service.
Vulnerability analysis
When a SCSI disk with a sector size larger than the page size is attached, the driver creates a large memory pool during probe. If this pool allocation fails under memory pressure, the error path incorrectly frees the disk structure while it is still registered in sysfs, creating a use-after-free condition where subsequent sysfs operations access freed memory. The fix properly unregisters the device and releases the disk reference before exiting the error path, ensuring the structure is freed only after all references are dropped. This vulnerability requires physical access to attach a SCSI device reporting an unusually large sector size, combined with sufficient memory pressure to cause the pool allocation to fail.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.6 | 748a14a0d41c |
| mainline | 7.1 | 7.3-rc1 | e3cc6ea1a745 |