CVE-2026-90268

What it actually does

Improper error handling in sd_probe() after device_add() succeeds causes kfree() on an already-registered device structure when sd_large_pool_create() fails, resulting in memory corruption and a leaked sysfs entry instead of delegating cleanup to scsi_disk_release().

Why it matters to the business

Storage device initialization failures on Linux systems can trigger kernel instability, crashes, or memory corruption during SCSI disk probing, increasing downtime and risk of data loss in environments reliant on block storage.

How an attack unfolds

An attacker triggers SCSI device attachment under conditions that cause sd_large_pool_create() to fail after device_add() has already succeeded, forcing the buggy error path to corrupt kernel memory structures associated with the disk device.

How to fix it

Apply the upstream kernel patch that corrects error handling in sd_probe() to unregister disk_dev and allow scsi_disk_release() to perform cleanup on large pool creation failure; update to a distribution kernel containing this fix.

How to confirm the fix worked

Inspect kernel source for the corrected sd_probe() error path, verify updated kernel packages from the vendor, and confirm absence of the double-free/sysfs leak pattern in sd.c.

Typical attack path

1. Initiate or wait for SCSI disk probe via sd_probe()
2. Force sd_large_pool_create() failure after successful device_add(&sdkp->disk_dev)
3. Trigger the incorrect out_free_index path that kfree()s a registered device
4. Exploit resulting memory corruption for denial of service or escalation

How to detect it

Review kernel logs and dmesg for sd_probe failure paths, scsi_disk_release references, sysfs registration errors, or oops traces involving sdkp and disk_dev around device attachment events.

What your security team should do

• Expedite kernel updates on all systems exposing SCSI storage devices
• Monitor kernel logs for sd_probe and scsi_disk oops/panic signatures
• Harden device probing paths and restrict untrusted SCSI attachment where feasible