Riskcovery

CVE-2024-35954

scsi: sg: Avoid sg device teardown race

State
Published
Severity
7.8 High
Published
May 20, 2024
Updated
Aug 5, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Avoid sg device teardown race

sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put().

sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device.

The resulting NULL pointer exception will then crash the kernel.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • db59133e927916d8a25ee1fd8264f2808040909d to before 46af9047523e2517712ae8e71d984286c626e022Affected
  • db59133e927916d8a25ee1fd8264f2808040909d to before b0d1ebcc1a9560e494ea9b3ee808540db26c5086Affected
  • db59133e927916d8a25ee1fd8264f2808040909d to before 27f58c04a8f438078583041468ec60597841284dAffected
  • 4cc664e59bf2553771e4c9e90f758f7434cfdc22Affected
  • 6.4.7 to before 6.5Affected
LinuxLinux
  • 6.5Affected
  • before 6.5Not affected
  • 6.6.28 through 6.6.*Not affected
  • 6.8.7 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.