scsi: elx: efct: Fix I/O leak on unsupported additional CDB (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efct_dispatch_fcp_cmd() allocates an efct_io before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before handing the IO to the SCSI layer. Free the allocated IO before returning from this error path.
Références
- https://git.kernel.org/stable/c/42a391d508e1f52fda5d81344e100a53c00898e3
- https://git.kernel.org/stable/c/9d479f50a6067954259414aa66d816c7df081286
- https://git.kernel.org/stable/c/8c689a8f229223cec4a821c65cfe40f8e8c56470
- https://git.kernel.org/stable/c/235159f75ab6f95484494db4cc031663e5ee4680
- https://git.kernel.org/stable/c/df87532e9212238509f23effd0ca39d9c3062d21
- https://git.kernel.org/stable/c/94cbfed191248dc88c23fc881119bb399486ddfd
- https://git.kernel.org/stable/c/9cb2d5291dbfe7bed565ead3337047dee9ed1064
Références européennes
- ENISA EUVD · EUVD-2026-59039
- GCVE · GCVE-0-2026-72081
Avis du CERT-FR
- CERTFR-2026-AVI-1432 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < 42a391d508e1f52fda5d81344e100a53c00898e3 ; affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < 9d479f50a6067954259414aa66d816c7df081286 ; affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < 8c689a8f229223cec4a821c65cfe40f8e8c56470 ; affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < 235159f75ab6f95484494db4cc031663e5ee4680 ; affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < df87532e9212238509f23effd0ca39d9c3062d21 ; affected f45ae6aac0a077ca15a6e7baae0a62eef099ea7d < 94cbfed191248dc88c23fc881119bb399486ddfd |
| Linux · Linux | affected 5.14 ; unaffected 0 < 5.14 ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* ; unaffected 6.12.97 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |