by Kastro
Paper/Archive/CVE-2024-26760

CVE-2024-26760

Linux Linux — scsi: target: pscsi: Fix bio_put() for error case

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.2.512 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(). That is not done properly for the error case, hitting WARN and NULL pointer dereference in bio_free().

Affected

ProductAffectedFixed inSource
Linux066ff571011d8416e903d3d4f1f41e0b5eb91e1d – < f49b20fd0134da84a6bd8108f9e73c077b7d6231f49b20fd0134da84a6bd8108f9e73c077b7d6231CNA
Linux066ff571011d8416e903d3d4f1f41e0b5eb91e1d – < 4ebc079f0c7dcda1270843ab0f38ab4edb8f79214ebc079f0c7dcda1270843ab0f38ab4edb8f7921CNA
Linux066ff571011d8416e903d3d4f1f41e0b5eb91e1d – < 1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec1cfe9489fb563e9a0c9cdc5ca68257a44428c2ecCNA
Linux066ff571011d8416e903d3d4f1f41e0b5eb91e1d – < de959094eb2197636f7c803af0943cb9d3b35804de959094eb2197636f7c803af0943cb9d3b35804CNA
Linux5.19–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231refgit.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921refgit.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ecrefgit.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804