SB20261023149 - Memory leak in Linux kernel scsi driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023149

SB20261023149 - Memory leak in Linux kernel scsi driver

Published: October 23, 2026

Security Bulletin ID SB20261023149
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Memory leak (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through repeated resource exhaustion.

The vulnerability exists due to missing cleanup of allocated memory in the Linux kernel SCSI changer driver's probe error path when ch_probe() fails after ch_readconfig(). A local privileged user can trigger such probe failures to leave the allocated data transfer device pointer array unreleased, potentially exhausting kernel memory if the failures are repeated.


Remediation

Install update from vendor's website.

References