{"id":"CVE-2024-26760","state":"PUBLISHED","title":"scsi: target: pscsi: Fix bio_put() for error case","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: pscsi: Fix bio_put() for error case\n\nAs of commit 066ff571011d (\"block: turn bio_kmalloc into a simple kmalloc\nwrapper\"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()\nand kfree(). That is not done properly for the error case, hitting WARN and\nNULL pointer dereference in bio_free().","publishedAt":"2024-04-03T17:00:44.230Z","updatedAt":"2026-08-05T11:27:03.216Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"f49b20fd0134da84a6bd8108f9e73c077b7d6231","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"4ebc079f0c7dcda1270843ab0f38ab4edb8f7921","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"de959094eb2197636f7c803af0943cb9d3b35804","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_pscsi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.80","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.19","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.7","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_pscsi.c"]}],"references":["https://git.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231","https://git.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921","https://git.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec","https://git.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26760.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26760","state":"PUBLISHED","datePublished":"2024-04-03T17:00:44.230Z","dateUpdated":"2026-08-05T11:27:03.216Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-19T14:20:24.171Z"},"containers":{"cna":{"title":"scsi: target: pscsi: Fix bio_put() for error case","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: pscsi: Fix bio_put() for error case\n\nAs of commit 066ff571011d (\"block: turn bio_kmalloc into a simple kmalloc\nwrapper\"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()\nand kfree(). That is not done properly for the error case, hitting WARN and\nNULL pointer dereference in bio_free()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"f49b20fd0134da84a6bd8108f9e73c077b7d6231","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"4ebc079f0c7dcda1270843ab0f38ab4edb8f7921","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec","versionType":"git"},{"version":"066ff571011d8416e903d3d4f1f41e0b5eb91e1d","status":"affected","lessThan":"de959094eb2197636f7c803af0943cb9d3b35804","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_pscsi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.80","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.19","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.7","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_pscsi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231"},{"url":"https://git.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921"},{"url":"https://git.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec"},{"url":"https://git.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The pscsi backstore is driven by SCSI CDBs arriving over a LIO fabric, primarily iscsi_target on TCP/3260, where the attacker-controlled Expected Data Transfer Length in a single remote SCSI Command PDU reaches pscsi_map_sg(). No local access is needed.\nAC:L - The failure path is entered deterministically by choosing a transfer length that exceeds the backing device's max_hw_sectors/max_segments, making the second blk_rq_append_bio() fail; the attacker fully controls this value and can also tune it so bi_max_vecs lands in the range that triggers the invalid kmem_cache_free.\nPR:N - passthrough_parse_cdb() applies no length validation, and an iSCSI initiator needs no secret — LIO demo mode (generate_node_acls/authentication=0) admits any initiator, and even with ACLs the initiator IQN is a self-declared string, not a credential.\nUI:N - The bug is triggered entirely by an attacker-sent SCSI command processed in the target's command path; no action by any local user or administrator is required.\nS:U - The invalid free and the resulting corruption/oops are confined to the host kernel, which is both the vulnerable and the impacted component; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - bvec_free() frees an interior pointer of the kmalloc'd bio into an unrelated biovec kmem_cache, splicing a kmalloc slab onto that cache's freelist and producing cross-cache overlapping allocations that can be groomed into an arbitrary kernel-memory read.\nI:H - The same invalid free is a slab-corruption primitive — biovec objects handed out over live kmalloc memory give type confusion and a write primitive over adjacent kernel objects, exploitable for control-flow hijack.\nA:H - bio_free() unconditionally dereferences the NULL bio_set via bs->front_pad, producing a WARN plus a guaranteed NULL pointer dereference oops in the target command path on every trigger, repeatable by the remote attacker (immediate panic with panic_on_oops/panic_on_warn)."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:27:03.216Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:14:13.227Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26760","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:51:34.318502Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:14.606Z"}}]}}}