CVE-2024-26845

scsi: target: core: Add TMF to tmr_list handling

State: Published
Severity: 7.5 High
Published: Apr 17, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Add TMF to tmr_list handling

An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core.

Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0

To fix this, only add abort to tmr_list if it will be handled by target core.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2281c95fe751325874d135b237ecdcd3bc34cc26 to before 11f3fe5001ed05721e641f0ecaa7a73b7deb245dAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before 168ed59170de1fd7274080fe102216162d6826cfAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before a9849b67b4402a12eb35eadc9306c1ef9847d53dAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before e717bd412001495f17400bfc09f606f1b594ef5aAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before 36bc5040c863b44af06094b22f1e50059227b9cbAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before bd508f96b5fef96d8a0ce9cbb211d82bcfc2341fAffected 2281c95fe751325874d135b237ecdcd3bc34cc26 to before 83ab68168a3d990d5ff39ab030ad5754cbbccb25Affected
LinuxLinux	5.1Affected before 5.1Not affected 5.4.270 through 5.4.Not affected 5.10.211 through 5.10.Not affected 5.15.150 through 5.15.Not affected 6.1.80 through 6.1.Not affected 6.6.19 through 6.6.Not affected 6.7.7 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

2281c95fe751325874d135b237ecdcd3bc34cc26 to before 11f3fe5001ed05721e641f0ecaa7a73b7deb245dAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before 168ed59170de1fd7274080fe102216162d6826cfAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before a9849b67b4402a12eb35eadc9306c1ef9847d53dAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before e717bd412001495f17400bfc09f606f1b594ef5aAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before 36bc5040c863b44af06094b22f1e50059227b9cbAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before bd508f96b5fef96d8a0ce9cbb211d82bcfc2341fAffected
2281c95fe751325874d135b237ecdcd3bc34cc26 to before 83ab68168a3d990d5ff39ab030ad5754cbbccb25Affected

LinuxLinux

5.1Affected
before 5.1Not affected
5.4.270 through 5.4.*Not affected
5.10.211 through 5.10.*Not affected
5.15.150 through 5.15.*Not affected
6.1.80 through 6.1.*Not affected
6.6.19 through 6.6.*Not affected
6.7.7 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.