---
id: CVE-2026-45872
title: 'scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

  pqi_report_phys_luns() fails to release the rpl_list buffer when
  encountering an unsupported data format or w…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    f471ecfec093e39ef8fd08978413793087daa14d
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    fdf1188cfa80f88c9f18d58cb33d57ff40e70e26
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    d52e13122d3771f753dd73ae6512fa01f58015cb
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    e5579ebaadc7b699868dad0f591a7bf83cd647e1
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    454570434114e4862767f506a442a0f110b639b2
  - >-
    Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 <
    41b37312bd9722af77ec7817ccf22d7a4880c289
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:43:06.508708Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:53:10.065Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45872'
references:
  - url: 'https://git.kernel.org/stable/c/f471ecfec093e39ef8fd08978413793087daa14d'
  - url: 'https://git.kernel.org/stable/c/fdf1188cfa80f88c9f18d58cb33d57ff40e70e26'
  - url: 'https://git.kernel.org/stable/c/d52e13122d3771f753dd73ae6512fa01f58015cb'
  - url: 'https://git.kernel.org/stable/c/e5579ebaadc7b699868dad0f591a7bf83cd647e1'
  - url: 'https://git.kernel.org/stable/c/454570434114e4862767f506a442a0f110b639b2'
  - url: 'https://git.kernel.org/stable/c/41b37312bd9722af77ec7817ccf22d7a4880c289'
tags:
  - cve.org
epss: 0.00171
epssPercentile: 0.06491
ingestedAt: '2026-11-06T16:57:43.393Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

pqi_report_phys_luns() fails to release the rpl_list buffer when
encountering an unsupported data format or when the allocation for
rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic,
leading to memory leaks.

Consolidate the error handling by adding an out_free_rpl_list label and use
goto statements to ensure rpl_list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and
code review.

## Affected

- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < f471ecfec093e39ef8fd08978413793087daa14d`
- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < fdf1188cfa80f88c9f18d58cb33d57ff40e70e26`
- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < d52e13122d3771f753dd73ae6512fa01f58015cb`
- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < e5579ebaadc7b699868dad0f591a7bf83cd647e1`
- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 454570434114e4862767f506a442a0f110b639b2`
- `Linux >= 28ca6d876c5a375094847606046e0bf5d044d9b4 < 41b37312bd9722af77ec7817ccf22d7a4880c289`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.