Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-35954

scsi: sg: Avoid sg device teardown race

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • db59133e927916d8a25ee1fd8264f2808040909d to < 46af9047523e2517712ae8e71d984286c626e022affected
  • db59133e927916d8a25ee1fd8264f2808040909d to < b0d1ebcc1a9560e494ea9b3ee808540db26c5086affected
  • db59133e927916d8a25ee1fd8264f2808040909d to < 27f58c04a8f438078583041468ec60597841284daffected
  • 4cc664e59bf2553771e4c9e90f758f7434cfdc22affected
  • 6.4.7 to < 6.5affected

Linux Linux

Default version status: affected

  • 6.5affected
  • 0 to < 6.5unaffected
  • 6.6.28 to ≤ 6.6.*unaffected
  • 6.8.7 to ≤ 6.8.*unaffected
  • 6.9 to ≤ *unaffected

References