CVE-2026-72088 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
A resource leak in the hpsa SCSI driver can lead to denial of service when IOACCEL2 reset paths are triggered.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72088?
CVE-2026-72088 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping the SCSI command, and dropping the outstanding IOACCEL command count before returning.
Which versions are affected by CVE-2026-72088?
How do I fix CVE-2026-72088?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72088 being exploited?
There is no known exploitation of CVE-2026-72088 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72088, DEBIAN-CVE-2026-72088, GHSA-pp64-c938-8878, UBUNTU-CVE-2026-72088.