In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Fix slab-use-after-free read in sg_release()
Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407
In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp.
After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error.
Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures:
- No references to sfp or sdp occur after the reference count is decremented.
- Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release().
The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.178-120.178Upgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.10.233-224.894Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perfUpgrade kernel-develUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.233-223.887Upgrade kernel-livepatch-5.10.234-225.895Upgrade kernel-livepatch-4.14.355-274.598Upgrade kernel-livepatch-5.10.230-223.885Upgrade bpftool-debuginfo | Feb 26, 2025 | Dec 27, 2024 |
| Amazon_linux | — | Upgrade kernel | Mar 7, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.124-134.200Upgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-headersUpgrade perfUpgrade python3-perfUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-livepatch-6.1.127-135.201Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extra | Feb 26, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 10, 2025 | Dec 27, 2024 |
| Dell Powerstore Dsa2025223 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 27, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel | Mar 18, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelists | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel | Mar 19, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Apr 1, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Mar 18, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Mar 12, 2025 | Dec 27, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 15, 2025 | Dec 27, 2024 |
| Ubuntu | — | Upgrade linux-image-azure-lts-24.04Upgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-gkeop-6.8Upgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-generic-64kUpgrade linux-image-azure-lts-18.04Upgrade linux-image-genericUpgrade linux-image-oem-20.04cUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-azure-nvidiaUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-intelUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-raspiUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-nvidiaUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-aws-hweUpgrade linux-image-azureUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-azure-fipsUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-oracle-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-oem-osp1Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-azure-lts-20.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-awsUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-raspi2Upgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-gcpUpgrade linux-image-oemUpgrade linux-image-4.15.0-1180-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-135-genericUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-oem-20.04Upgrade linux-image-fipsUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.11.0-1011-awsUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-oem-22.04dUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-20.04bUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-intel-iotgUpgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-ibm | Mar 28, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 29, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub