What’s Vulnerable › Vulnerabilities

CVE-2024-35954: scsi: sg: Avoid sg device teardown race

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-20 · updated 2026-08-04
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.

Affected products

• Linux kernel: from 6.4.7 before 6.6.28; from 6.7 before 6.8.7; 6.9-rc1 — fixed in 6.6.28, 6.8.7

How to fix

Upgrade to a fixed version: Linux kernel 6.6.28, 6.8.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d
• https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022
• https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086
• https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d
• https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022
• https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086

Get alerted when CVE-2024-35954 or the next vulnerability affects your stack