Vulnerabilities > CVE-2024-35954 - Unspecified vulnerability in Linux Kernel
Attack vector
LOCAL Attack complexity
HIGH Privileges required
LOW Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.
Vulnerable Configurations
References
- https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d
- https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d
- https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022
- https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022
- https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086
- https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086