CVE-2024-50153: scsi: target: core: Fix null-ptr-deref in target_alloc_device()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-07 · updated 2026-10-15
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().

Affected products

Linux kernel: from 5.11 before 5.15.170; from 5.16 before 6.1.115; from 6.2 before 6.6.59; from 6.7 before 6.11.6; 5.10.180, 6.12-rc1, 6.12-rc2, 6.12-rc3 — fixed in 5.15.170, 6.1.115, 6.11.6, 6.6.59

How to fix

Upgrade to a fixed version: Linux kernel 5.15.170, 6.1.115, 6.11.6, 6.6.59. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50153 or the next vulnerability affects your stack