Riskcovery

CVE-2021-47258

scsi: core: Fix error handling of scsi_host_alloc()

State
Published
Severity
Not scored
Published
May 21, 2024
Updated
May 11, 2026
Reserved
Apr 10, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix error handling of scsi_host_alloc()

After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name().

Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 8958181c1663e24a13434448e7d6b96b5d04900aAffected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before db08ce595dd64ea9859f7d088b51cbfc8e685c66Affected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 2dc85045ae65b9302a1d2e2ddd7ce4c030153a6aAffected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 79296e292d67fa7b5fb8d8c27343683e823872c8Affected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 7a696ce1d5d16a33a6cd6400bbcc0339b2460e11Affected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 45d83db4728127944b237c0c8248987df9d478e7Affected
  • 1fa5ae857bb14f6046205171d98506d8112dd74e to before 66a834d092930cf41d809c0e989b13cd6f9ca006Affected
LinuxLinux
  • 2.6.30Affected
  • before 2.6.30Not affected
  • 4.9.273 through 4.9.*Not affected
  • 4.14.237 through 4.14.*Not affected
  • 4.19.195 through 4.19.*Not affected
  • 5.4.126 through 5.4.*Not affected
  • 5.10.44 through 5.10.*Not affected
  • 5.12.11 through 5.12.*Not affected
  • 5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.