Strix
63.9K

CVE-2026-90268

HIGHCVSS 8.1/10

Last modified

CVE-2026-90268 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry..

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 7179e626b76eb42f2529c6f6dd6ba88ea2445372, < 748a14a0d41cfe3017251c11b314f85045414942; >= 7179e626b76eb42f2529c6f6dd6ba88ea2445372, < e3cc6ea1a745e7f5d326f919a428b244fa119d8f
LinuxLinux7.1

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90268?
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sd_probe() after large pool creation failure After device_add(&sdkp->disk_dev) succeeds, sd_large_pool_create() failure must unregister disk_dev and let scsi_disk_release() free sdkp. Going through out_free_index kfree()s an already registered device and leaks the sysfs entry.
How severe is CVE-2026-90268?
CVE-2026-90268 has a CVSS score of 8.1/10 (HIGH severity).
How do I fix CVE-2026-90268?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90268?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST