CVE-2026-45997: Linux Kernel Privilege Escalation Flaw

CVE-2026-45997 Overview

CVE-2026-45997 is a resource management flaw in the Linux kernel SCSI disk (sd) driver. The vulnerability stems from a missing put_disk() call in the error-handling path of sd_probe() when device_add(&sdkp->disk_dev) fails. In that failure path, put_device() invokes scsi_disk_release(), which frees the scsi_disk structure but leaves the associated gendisk referenced. This leaks the gendisk reference and can result in resource exhaustion or use-after-free style instability over repeated failures.

Critical Impact
A missed reference release in the SCSI disk probe error path leaks gendisk objects, causing kernel memory leaks and potential instability on systems that repeatedly exercise the failure path.

Affected Products

Linux kernel SCSI subsystem (drivers/scsi/sd.c)
Stable kernel branches referenced in the upstream fix commits
Linux distributions shipping the affected SCSI disk driver

Discovery Timeline

2026-05-27 - CVE-2026-45997 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45997

Vulnerability Analysis

The Linux kernel SCSI disk driver registers a gendisk and an associated device during sd_probe(). When the driver calls device_add(&sdkp->disk_dev) and that call fails, the cleanup path invokes put_device(). This triggers scsi_disk_release(), which frees the scsi_disk allocation but does not release the gendisk reference acquired earlier in probe.

The correct cleanup mirrors the existing device_add_disk() error path in sd_probe(), which calls put_disk(gd). Without that call, the gendisk refcount never reaches zero, so its memory and associated block-layer state remain allocated indefinitely. This is a kernel resource leak in an error path [CWE-401].

Repeated triggering of the failure path, for example through hot-plug churn or fault injection, gradually exhausts kernel memory. In environments where attackers can influence probe failures, the leak compounds and degrades system reliability.

Root Cause

The root cause is an asymmetric reference-counting pattern in sd_probe(). The success path balances gendisk acquisition with a later put_disk(), but the device_add() failure branch only releases the scsi_disk via scsi_disk_release() without releasing the gendisk. The fix adds the missing put_disk(gd) call to restore symmetry.

Attack Vector

Exploitation requires the ability to induce repeated device_add() failures during SCSI disk probing. This is typically a local condition tied to hardware, hotplug events, or kernel fault injection rather than a remote attack surface. The practical impact is denial of service through kernel memory exhaustion rather than code execution.

No public proof-of-concept code is referenced in the advisory. Readers should consult the upstream commits for the precise patch diff, including commit 13e550fb and commit 1e111c4b.

Detection Methods for CVE-2026-45997

Indicators of Compromise

Growing kernel slab usage attributable to gendisk allocations without matching frees in /proc/slabinfo.
Repeated SCSI probe failure messages in dmesg referencing device_add errors followed by scsi_disk_release.
Gradual reduction in available kernel memory on hosts exercising SCSI hotplug or fault-injection paths.

Detection Strategies

Compare the running kernel version against the fixed commits referenced in the NVD entry to identify unpatched hosts.
Monitor dmesg and journald logs for SCSI subsystem probe failures correlated with rising slab counters.
Use kernel memory leak detectors such as kmemleak on test systems to confirm the gendisk leak on the failure path.

Monitoring Recommendations

Track kernel memory consumption trends per host and alert on sustained, unexplained growth.
Audit storage hotplug events and SCSI probe failures, which are the precondition for triggering the leak.
Centralize kernel logs and slab statistics so that anomalies across a fleet can be correlated and investigated.

How to Mitigate CVE-2026-45997

Immediate Actions Required

Identify Linux hosts running kernel versions that predate the fix commits and prioritize them for patching.
Apply the vendor-supplied kernel update from your Linux distribution as soon as it is available.
Reduce exposure on affected hosts by limiting unnecessary SCSI hotplug activity until patches are deployed.

Patch Information

The issue is resolved by adding the missing put_disk(gd) call in the device_add(&sdkp->disk_dev) failure path of sd_probe(). The fix is available in the upstream stable tree across multiple branches. See the patch commits: 13e550fb, 1e111c4b, 262152ec, a95d38c5, and b64b4f49.

Workarounds

No supported configuration workaround exists; the missing put_disk() must be added in source.
On unpatched systems, schedule periodic reboots to reclaim leaked kernel memory until the fix is applied.
Avoid intentional fault injection against the SCSI subsystem on production hosts running unpatched kernels.

bash

# Verify the running kernel and check distribution advisories for the patch
uname -r
# Example: query slab usage for gendisk-related allocations
grep -E 'gendisk|blkdev' /proc/slabinfo
# Apply distribution updates once available
# Debian/Ubuntu:
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f2-)
# RHEL/Rocky/Alma:
sudo dnf update kernel