Memory Leak in Linux Kernel SCSI LPFC Driver

Executive Summary

This is a memory leak vulnerability in the Linux kernel's SCSI driver (lpfc). The issue occurs in the lpfc_sli4_driver_resource_setup() function where memory allocated for mboxq using mempool_alloc() is not freed in certain error paths. The fix moves the mempool_free() call to an earlier point after the memory is no longer needed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's lpfc driver and involves a memory leak in error paths. Detection requires checking for memory leaks in the lpfc driver or kernel logs. Use commands like dmesg | grep lpfc or journalctl -k | grep lpfc to inspect driver logs for memory allocation issues. Ensure your kernel version includes the fix by checking with uname -r and comparing against patched versions.

Useful 0 Not Useful 0

Impact Analysis

The memory leak could lead to gradual exhaustion of system memory over time, potentially causing performance degradation or system instability. This may result in crashes or slowdowns in systems running vulnerable Linux kernel versions with the affected SCSI driver.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves a memory leak in the Linux kernel's SCSI driver (lpfc) due to improper freeing of allocated memory in error paths. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. However, unpatched systems could experience resource exhaustion, potentially leading to service disruptions that may indirectly affect compliance with uptime or reliability standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for CVE-2026-72087. Monitor system logs for memory leaks related to the lpfc driver.

Useful 0 Not Useful 0