Cloudanix VulnDB

CVE-2026-90267

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel cleans up memory for certain disk commands can slowly leak memory when things go wrong, which might eventually slow down or crash storage systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Failure to release a specially allocated payload page when scsi_alloc_sgtables() returns an error after sd_set_special_bvec() has already allocated memory for UNMAP or WRITE SAME commands, because RQF_DONTPREP is not yet set and uninit_command() is therefore skipped.

Why it matters to the business

Gradual memory exhaustion on Linux systems performing frequent storage management I/O under transient allocation-failure conditions, potentially leading to degraded performance or instability in storage-heavy workloads; low immediate urgency given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with local access or the ability to influence block-layer I/O patterns repeatedly triggers the error path in sd_setup_unmap_cmnd or sd_setup_write_same* after the special payload page has been allocated but before RQF_DONTPREP is set, causing the page to be leaked from the mempool on each occurrence until memory pressure becomes noticeable.

How to fix it

Update the Linux kernel to a version containing the fix that invokes sd_uninit_command() on the error path and clears RQF_SPECIAL_PAYLOAD after freeing the page; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Inspect the sd.c source for the presence of the sd_uninit_command() call and RQF_SPECIAL_PAYLOAD clearing logic in the error paths of sd_setup_unmap_cmnd and sd_setup_write_same*; verify the running kernel version or commit history includes the resolution.

Typical attack path

  1. Obtain local execution or I/O control on a Linux host using the vulnerable sd driver
  2. Craft or induce conditions that cause scsi_alloc_sgtables() to fail immediately after sd_set_special_bvec() succeeds for UNMAP or WRITE SAME
  3. Repeat the triggering sequence to accumulate leaked pages in the mempool
  4. Monitor system memory until exhaustion impacts availability or triggers secondary failures

How to detect it

Review kernel logs and memory accounting for repeated allocation failures in the SCSI midlayer without corresponding page frees; examine slab or mempool statistics for growth in special-payload objects under storage I/O error conditions.

What your security team should do

  • Prioritize kernel updates for storage servers and hypervisors handling UNMAP/WRITE SAME workloads
  • Monitor memory usage trends on systems that perform frequent block management commands
  • Apply the fix during the next scheduled maintenance window given the low EPSS and non-KEV status

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page. Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page.

Affected packages

Ecosystem Package Introduced Fixed