In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix a use-after-free
There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed.
This commit fixes the following use-after-free:
================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-5.10.223-211.872Upgrade kernel-livepatch-5.10.217-205.860-debuginfoUpgrade kernel-livepatch-5.15.164-108.161Upgrade kernel-livepatch-5.10.218-206.860-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.220-209.869Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.218-208.862Upgrade kernel-tools-develUpgrade kernel-livepatch-5.10.218-206.860Upgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.219-208.866Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.220-209.867Upgrade perfUpgrade kernel-livepatch-5.10.217-205.860Upgrade perf-debuginfoUpgrade kernel-livepatch-5.10.218-208.862-debuginfoUpgrade kernel-debuginfoUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-devel | Aug 14, 2024 | Apr 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Oct 8, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | Apr 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-20.04Upgrade linux-image-awsUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracleUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-azure-cvmUpgrade linux-image-virtualUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1072-awsUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1075-azureUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-kvmUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1067-intel-iotg | Nov 12, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub