Riskcovery

CVE-2024-54458

scsi: ufs: bsg: Set bsg_queue to NULL after removal

State
Published
Severity
7.8 High
Published
Feb 27, 2025
Updated
Oct 15, 2026
Reserved
Feb 27, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before bb4783c670180b922267222408e1c48d22dfbb46Affected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 22018622e1e9e371198dbd983af946a844d5924cAffected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 5e7b6e44468c3242c21c2a8656d009fb3eb50a73Affected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 5f782d4741bf558def60df192b858b0efc6a5f0aAffected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 88a01e9c9ad40c075756ba93b47984461d4ff15dAffected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 9193bdc170cc23fe98aca71d1a63c0bf6e1e853bAffected
  • df032bf27a414acf61c957ec2fad22a57d903b39 to before 1e95c798d8a7f70965f0f88d4657b682ff0ec75fAffected
LinuxLinux
  • 4.20Affected
  • before 4.20Not affected
  • 5.10.237 through 5.10.*Not affected
  • 5.15.181 through 5.15.*Not affected
  • 6.1.129 through 6.1.*Not affected
  • 6.6.79 through 6.6.*Not affected
  • 6.12.16 through 6.12.*Not affected
  • 6.13.4 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.