Answer in brief
CVE-2026-45997 records a Unknown severity vulnerability in scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <2c2c14b7dfccad8c5a28802849e40c21252e4c28 || >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <262152ec37101f9dc524743ccdbd6c7641d14573 || >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <b64b4f499801b12d0e2785447e4df6c164c608a9 || >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <13e550fbfccdb311e76ec96892dfe35f0dba0657 || >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <a95d38c5701431bfc826e7b18acc0785919d5c88 || >=265dfe8ebbabae7959060bd1c3f75c2473b697ed <1e111c4b3a726df1254670a5cc4868cedb946d37 || d56459d361a9a99bead8b594635353053271356c || a3e5a9208466b63f27a2509a691023b446ea5105 || 4e8e6427319de323f613caa8fd37120df83138d0 || eadb60bcc2005247d97dcb3becee57aba4024ff4 || 350d048cc506368a316f0bc4082426b24a2a9fc0 || 60df9f55562a57173a11b6c7011eee40dfa48157 || e95f62013a1159eeea752bb52df0683ee77f70ca || >=4.4.288 <4.5 || >=4.9.286 <4.10 || >=4.14.250 <4.15 || >=4.19.210 <4.20 || >=5.4.152 <5.5 || >=5.10.72 <5.11 || >=5.14.11 <5.15 | 2c2c14b7dfccad8c5a28802849e40c21252e4c28, 262152ec37101f9dc524743ccdbd6c7641d14573, b64b4f499801b12d0e2785447e4df6c164c608a9, 13e550fbfccdb311e76ec96892dfe35f0dba0657, a95d38c5701431bfc826e7b18acc0785919d5c88, 1e111c4b3a726df1254670a5cc4868cedb946d37, 4.5, 4.10, 4.15, 4.20, 5.5, 5.11, 5.15 |
| Linux/Linuxgeneric | 5.15 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup.
Quoted source text, attributed separately from HOL analysis.