CVE-2026-90267

sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.

Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90267.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87

Fixed

710a2448a06a8215ba8acb4a2791954800f7db0a

Fixed

744a65e113094756e6c1cfba9ff1bf4247cb68d4

Fixed

e90f746f4ca3896ca560e820b7b6b0a467026938

Fixed

5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d

Fixed

bb31844d88b77138b67aa20c3600203baff40140

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90267.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.12.0

Fixed

6.6.160

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.114

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.57

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.2.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90267.json"