CVE-2026-72088

Received Received - Intake

DMA Mapping Leak in Linux Kernel HPSA Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping the SCSI command, and dropping the outstanding IOACCEL command count before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72088

EUVD

EUVD-2026-59046

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a DMA mapping leak in the hpsa SCSI driver. When a reset operation occurs and a specific flag (phys_disk->in_reset) is set, the function exits early without properly releasing resources. This includes unmapping the IOACCEL2 SG chain block, unmapping the SCSI command, and reducing the outstanding IOACCEL command count.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI hpsa driver and involves a DMA mapping leak during IOACCEL2 reset operations. Detection requires checking kernel logs for errors related to hpsa or SCSI commands, particularly during device resets. Commands like dmesg | grep hpsa or journalctl -k | grep hpsa may reveal issues. Ensure your kernel version is updated to the patched release.

Impact Analysis

This vulnerability could lead to resource exhaustion, such as memory or DMA mappings, potentially causing system instability or crashes. Systems using the hpsa SCSI driver with IOACCEL2 devices may experience performance degradation or unexpected failures during reset operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel issue related to resource management in the SCSI subsystem. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-72088. Reboot the system to load the updated kernel. Monitor system logs for any recurring errors related to hpsa or SCSI commands after applying the patch.

Hi! I’m here to help you understand CVE-2026-72088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70