PT-2026-43864 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-45997

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference-count leak occurs in the SCSI subsystem. When the device add(&disk dev) function fails, put device() triggers scsi disk release(), which frees the scsi disk but fails to release the gendisk reference. This results in a missing put disk() call during the cleanup process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-45997

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-45997 · Security Note
• https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9 · Note
• https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88 · Note
• https://twitter.com/windowsforum/status/2059922006083014665 · Twitter Post
• https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37 · Note
• https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657 · Note
• https://git.kernel.org/stable/c/2c2c14b7dfccad8c5a28802849e40c21252e4c28 · Note
• https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573 · Note