What’s Vulnerable › Vulnerabilities

CVE-2024-26760: scsi: target: pscsi: Fix bio_put() for error case

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-03 · updated 2026-08-04
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(). That is not done properly for the error case, hitting WARN and NULL pointer dereference in bio_free().

Affected products

• Linux kernel: from 5.19 before 6.1.80; from 6.2 before 6.6.19; from 6.7 before 6.7.7; 6.8-rc1, 6.8-rc2, 6.8-rc3, 6.8-rc4, 6.8-rc5 — fixed in 6.1.80, 6.6.19, 6.7.7

How to fix

Upgrade to a fixed version: Linux kernel 6.1.80, 6.6.19, 6.7.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec
• https://git.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921
• https://git.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804
• https://git.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231
• https://git.kernel.org/stable/c/1cfe9489fb563e9a0c9cdc5ca68257a44428c2ec
• https://git.kernel.org/stable/c/4ebc079f0c7dcda1270843ab0f38ab4edb8f7921
• https://git.kernel.org/stable/c/de959094eb2197636f7c803af0943cb9d3b35804
• https://git.kernel.org/stable/c/f49b20fd0134da84a6bd8108f9e73c077b7d6231

Get alerted when CVE-2024-26760 or the next vulnerability affects your stack