{"id":"CVE-2026-45872","title":"scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix memory leak in pqi_report_phys_luns()\n\npqi_report_phys_luns() fails to release the rpl_list buffer when\nencountering an unsupported data format or w…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < f471ecfec093e39ef8fd08978413793087daa14d","Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < fdf1188cfa80f88c9f18d58cb33d57ff40e70e26","Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < d52e13122d3771f753dd73ae6512fa01f58015cb","Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < e5579ebaadc7b699868dad0f591a7bf83cd647e1","Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 454570434114e4862767f506a442a0f110b639b2","Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 41b37312bd9722af77ec7817ccf22d7a4880c289","Linux 5.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:43:06.508708Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:53:10.065Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45872","references":[{"url":"https://git.kernel.org/stable/c/f471ecfec093e39ef8fd08978413793087daa14d"},{"url":"https://git.kernel.org/stable/c/fdf1188cfa80f88c9f18d58cb33d57ff40e70e26"},{"url":"https://git.kernel.org/stable/c/d52e13122d3771f753dd73ae6512fa01f58015cb"},{"url":"https://git.kernel.org/stable/c/e5579ebaadc7b699868dad0f591a7bf83cd647e1"},{"url":"https://git.kernel.org/stable/c/454570434114e4862767f506a442a0f110b639b2"},{"url":"https://git.kernel.org/stable/c/41b37312bd9722af77ec7817ccf22d7a4880c289"}],"tags":["cve.org"],"epss":0.00171,"epssPercentile":0.06491,"ingestedAt":"2026-11-06T16:57:43.393Z","slug":"CVE-2026-45872","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix memory leak in pqi_report_phys_luns()\n\npqi_report_phys_luns() fails to release the rpl_list buffer when\nencountering an unsupported data format or when the allocation for\nrpl_16byte_wwid_list fails. These early returns bypass the cleanup logic,\nleading to memory leaks.\n\nConsolidate the error handling by adding an out_free_rpl_list label and use\ngoto statements to ensure rpl_list is consistently freed on failure.\n\nCompile tested only. Issue found using a prototype static analysis tool and\ncode review.\n\n## Affected\n\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < f471ecfec093e39ef8fd08978413793087daa14d`\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < fdf1188cfa80f88c9f18d58cb33d57ff40e70e26`\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < d52e13122d3771f753dd73ae6512fa01f58015cb`\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < e5579ebaadc7b699868dad0f591a7bf83cd647e1`\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 454570434114e4862767f506a442a0f110b639b2`\n- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 41b37312bd9722af77ec7817ccf22d7a4880c289`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}