CVE-2026-45997 scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
A missing put_disk() call in the Linux kernel SCSI driver can lead to a null pointer dereference and system crash when device addition fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45997?
CVE-2026-45997 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.
Which versions are affected by CVE-2026-45997?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45997?
Apply the vendor's patch.
Is CVE-2026-45997 being exploited?
There is no known exploitation of CVE-2026-45997 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88782, BELL-CVE-2026-45997, DEBIAN-CVE-2026-45997, GHSA-9h33-65cj-82pc, ROOT-OS-DEBIAN-11-CVE-2026-45997, ROOT-OS-DEBIAN-12-CVE-2026-45997 and 3 more.