CVE-2026-45872: Linux Kernel Memory Leak Vulnerability

CVE-2026-45872 Overview

CVE-2026-45872 is a memory leak vulnerability in the Linux kernel's smartpqi SCSI driver. The flaw resides in the pqi_report_phys_luns() function, which fails to release the rpl_list buffer when the driver encounters an unsupported data format or when allocation of rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic, leaking kernel memory on each failure path. The issue was identified through a prototype static analysis tool and code review, and was fixed by consolidating error handling under an out_free_rpl_list label using goto statements. The fix has been compile-tested only.

Critical Impact
Repeated triggering of the failure paths in pqi_report_phys_luns() can exhaust kernel memory on systems using Microsemi smartpqi SAS/SATA controllers, potentially leading to denial of service.

Affected Products

Linux kernel scsi: smartpqi driver (multiple stable branches)
Systems using Microsemi smartpqi SAS/SATA HBA controllers
Distributions shipping unpatched Linux kernels referenced by the upstream commits

Discovery Timeline

2026-05-27 - CVE-2026-45872 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45872

Vulnerability Analysis

The pqi_report_phys_luns() function in the smartpqi SCSI driver is responsible for reporting physical logical units (LUNs) attached to the host bus adapter. During its execution, the function allocates an rpl_list buffer to hold reported LUN data, and subsequently attempts to allocate an rpl_16byte_wwid_list buffer used for 16-byte World Wide Name identifiers.

Two error paths exit the function without freeing the previously allocated rpl_list buffer. The first occurs when the data format returned by the controller is not supported. The second occurs when the secondary rpl_16byte_wwid_list allocation fails. In both cases, the function returns directly, leaving rpl_list allocated in kernel memory.

This is a classic kernel memory leak [CWE-401]. Each invocation that hits these error paths permanently consumes kernel heap memory until the system is rebooted.

Root Cause

The root cause is inconsistent cleanup logic across multiple exit paths in pqi_report_phys_luns(). The function uses direct return statements on failure rather than routing through a unified error handler. The upstream fix introduces an out_free_rpl_list label and replaces direct returns with goto statements, ensuring rpl_list is freed on every failure path.

Attack Vector

Triggering the leak requires conditions that cause the smartpqi controller to return an unsupported data format, or that cause kmalloc-class allocations to fail under memory pressure. A local attacker with the ability to induce repeated LUN scans or sustained memory pressure on an affected host could amplify the leak. The vulnerability does not provide code execution or information disclosure; its impact is degradation of kernel memory availability over time.

No verified public proof-of-concept code is available. See the upstream commits referenced below for the precise code change.

Detection Methods for CVE-2026-45872

Indicators of Compromise

Gradual reduction in MemAvailable and increase in Slab usage reported by /proc/meminfo on hosts using smartpqi controllers.
Kernel log entries from the smartpqi driver reporting unsupported report-LUNs data formats or failed memory allocations.
Unexplained out-of-memory (OOM) events on systems with otherwise stable workloads using Microsemi SAS/SATA HBAs.

Detection Strategies

Inventory kernel versions across Linux fleets and identify hosts running unpatched smartpqi driver builds.
Track kmalloc allocation accounting via kmemleak (CONFIG_DEBUG_KMEMLEAK) on test systems to confirm presence of leaked rpl_list allocations.
Correlate dmesg output containing smartpqi with memory utilization trends in observability platforms.

Monitoring Recommendations

Alert on sustained growth of kernel slab memory on hosts using affected controllers.
Monitor dmesg for repeated smartpqi report-LUNs failures and feed events into centralized log analytics.
Track kernel package versions in configuration management to confirm patch deployment status.

How to Mitigate CVE-2026-45872

Immediate Actions Required

Apply the upstream Linux kernel patch that introduces the out_free_rpl_list cleanup label in pqi_report_phys_luns().
Upgrade to a distribution kernel that includes one of the referenced stable backports.
Reboot affected hosts after patching to clear any kernel memory already leaked.

Patch Information

The fix has been merged across multiple Linux stable branches. Refer to the upstream commits: Kernel Git Commit 41b37312, Kernel Git Commit 45457043, Kernel Git Commit d52e1312, Kernel Git Commit e5579eba, Kernel Git Commit f471ecfe, and Kernel Git Commit fdf1188c.

Workarounds

No direct workaround exists in the driver. Limit exposure by avoiding configurations that repeatedly trigger LUN rescans on affected controllers.
Schedule periodic reboots on long-running hosts using the smartpqi driver until the patched kernel is deployed.
Where supported, migrate workloads to hosts running a patched kernel build.

bash

# Verify running kernel version and smartpqi module status
uname -r
modinfo smartpqi | grep -E '^(version|filename)'

# Check for smartpqi report-LUNs related messages
dmesg | grep -i smartpqi

# Monitor kernel slab memory growth on affected hosts
watch -n 60 'grep -E "Slab|MemAvailable" /proc/meminfo'