CVE-2021-47258: scsi: core: Fix error handling of scsi_host_alloc()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.

Affected products

Linux kernel: before 4.9.273; from 4.10 before 4.14.237; from 4.15 before 4.19.195; from 4.20 before 5.4.126; from 5.5 before 5.10.44; from 5.11 before 5.12.11 — fixed in 4.14.237, 4.19.195, 4.9.273, 5.10.44, 5.12.11, 5.4.126

How to fix

Upgrade to a fixed version: Linux kernel 4.14.237, 4.19.195, 4.9.273, 5.10.44. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47258 or the next vulnerability affects your stack