Executive brief
A memory leak vulnerability was identified in the Linux kernel's smartpqi driver, which manages certain storage controllers. When the system encounters specific hardware errors or memory allocation failures while reporting physical storage devices, it fails to release previously allocated memory. Over time, this could lead to reduced system performance or instability as available memory is exhausted.
Technical details
A memory leak exists in the pqi_report_phys_luns() function within drivers/scsi/smartpqi/smartpqi_init.c. The vulnerability is triggered when the function encounters an unsupported data format or fails to allocate memory for rpl_16byte_wwid_list; in these error paths, the function returns early without freeing the previously allocated rpl_list buffer. This is a classic resource management error where cleanup logic is bypassed. An attacker or a series of hardware events could potentially trigger these paths to exhaust kernel memory. The fix consolidates error handling using a goto label to ensure rpl_list is consistently freed.
Affected products
- Linux Linux Kernel Fixed in 41b37312bd9722af77ec7817ccf22d7a4880c289 and related stable branches
Timeline
- 2026-01-31: other: Patch authored
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/41b37312bd9722af77ec7817ccf22d7a4880c289
- https://git.kernel.org/stable/c/454570434114e4862767f506a442a0f110b639b2
- https://git.kernel.org/stable/c/d52e13122d3771f753dd73ae6512fa01f58015cb
- https://git.kernel.org/stable/c/e5579ebaadc7b699868dad0f591a7bf83cd647e1
- https://git.kernel.org/stable/c/f471ecfec093e39ef8fd08978413793087daa14d
- https://git.kernel.org/stable/c/fdf1188cfa80f88c9f18d58cb33d57ff40e70e26