PT-2026-43739 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45872

Mitre

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Fix memory leak in pqi report phys luns()

pqi report phys luns() fails to release the rpl list buffer when encountering an unsupported data format or when the allocation for rpl 16byte wwid list fails. These early returns bypass the cleanup logic, leading to memory leaks.

Consolidate the error handling by adding an out free rpl list label and use goto statements to ensure rpl list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Related Identifiers

CVE-2026-45872

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-45872 · Security Note
• https://git.kernel.org/stable/c/454570434114e4862767f506a442a0f110b639b2 · Note
• https://git.kernel.org/stable/c/e5579ebaadc7b699868dad0f591a7bf83cd647e1 · Note
• https://git.kernel.org/stable/c/fdf1188cfa80f88c9f18d58cb33d57ff40e70e26 · Note
• https://git.kernel.org/stable/c/f471ecfec093e39ef8fd08978413793087daa14d · Note
• https://git.kernel.org/stable/c/d52e13122d3771f753dd73ae6512fa01f58015cb · Note
• https://git.kernel.org/stable/c/41b37312bd9722af77ec7817ccf22d7a4880c289 · Note