Linux Kernel CVE-2026-45997

The Linux kernel SCSI disk driver (sd.c) uses a two-layer device model: a scsi_disk structure wraps a gendisk (struct gendisk), which is the kernel's generic disk abstraction. Both are reference-counted via put_device()/scsi_disk_release() and put_disk() respectively. During sd_probe(), the driver allocates a scsi_disk, initialises a gendisk, then calls device_add(&sdkp->disk_dev) to register the device in sysfs. If device_add() fails, put_device() on the disk_dev triggers scsi_disk_release(), freeing the scsi_disk - but the gendisk's reference count is not decremented because put_disk(gd) is never called on this error path. The parallel error path inside device_add_disk() does call put_disk(), but that path is not reached when device_add() itself fails before it. The CPE data (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) confirms the affected component is the Linux kernel across all versions prior to the stable-branch fixes. Although no CWE is formally assigned, this is a classic CWE-772 (Missing Release of Resource after Effective Lifetime) / CWE-401 (Missing Release of Memory after Effective Lifetime) pattern applied to a kernel reference count.