Executive brief
The Linux kernel's SCSI disk (sd) driver contains an error handling bug in the sd_probe() function that occurs when allocating memory for large storage sector sizes. When the large memory pool allocation fails after the disk device has been registered, the cleanup code incorrectly attempts to free an already-registered device, causing a memory leak and sysfs corruption that can degrade system stability.
Technical details
This is a resource cleanup bug (CWE-413: Improper Resource Validation) in the sd driver's sd_probe() function. The vulnerability occurs in the error handling path when sd_large_pool_create() fails after device_add(&sdkp->disk_dev) has already succeeded. The flawed code path goes through out_free_index which calls kfree() on an already-registered device, leaking the sysfs entry and causing device state inconsistency. The fix properly unregisters the disk device and releases the disk allocation before unwinding. The bug affects systems using SCSI disks with sector sizes larger than PAGE_SIZE, and is triggered during device probing when memory allocation fails. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions including 5.x, 6.x, 7.x series
Timeline
- 2026-09-17: disclosed: CVE-2026-90268 published on NVD
- 2026-08-07: patched: Fix merged upstream commit e3cc6ea1a745e7f5d326f919a428b244fa119d8f
- 2026-09-14: patched: Fix included in stable kernel releases