Executive brief
The Linux kernel's SCSI disk (SD) driver has a memory leak in its handling of UNMAP and WRITE SAME commands. When memory allocation fails during command setup, previously allocated pages are not properly freed, causing kernel memory to be gradually consumed. This can lead to gradual system degradation and eventually impact system stability and availability.
Technical details
The vulnerability is a resource leak (CWE-401) in the SCSI SD driver's sd_setup_unmap_cmnd() and sd_setup_write_same{10,16}_cmnd() functions. The sd_set_special_bvec() function allocates a special payload page for UNMAP and WRITE SAME commands, but if scsi_alloc_sgtables() fails immediately afterward, the SCSI midlayer does not call uninit_command() to free the allocated page because the RQF_DONTPREP flag has not yet been set. The fix adds explicit error handling that calls sd_uninit_command() to properly free the allocated page and clear the RQF_SPECIAL_PAYLOAD flag when scsi_alloc_sgtables() fails. This is a local kernel issue affecting any system using SCSI disks.
Affected products
- Linux Linux Kernel Multiple versions (see kernel.org for affected branches)
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched