CVE-2024-26760

What it actually does

In the Linux kernel SCSI target pscsi driver, a bio allocated via bio_kmalloc is not freed with bio_uninit and kfree on error paths, triggering WARN and NULL pointer dereference in bio_free.

Why it matters to the business

Systems using the SCSI target subsystem with pscsi may experience kernel warnings or crashes when error conditions occur during I/O handling, leading to service disruption on affected Linux hosts.

How an attack unfolds

A local attacker triggers an error condition in the pscsi error handling path to force improper bio cleanup, resulting in a NULL pointer dereference that can be used to crash the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit f49b20fd0134da84a6bd8108f9e73c077b7d6231 or later; rebuild and reboot with the patched kernel. For package-based distributions, apply the vendor-provided kernel update that resolves the bio_put error handling.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable version; attempt to reproduce error paths in pscsi with monitoring for bio_free warnings; inspect source for bio_uninit + kfree usage after bio_kmalloc.

Typical attack path

1. Obtain local access to a system running a vulnerable Linux kernel with the SCSI target pscsi module enabled.
2. Craft input that causes an error during bio allocation in the pscsi target path.
3. Trigger the faulty error handling to invoke bio_free on an incorrectly allocated bio.
4. Observe kernel warning and potential NULL pointer dereference leading to system instability.

How to detect it

Search kernel logs for bio_free warnings or NULL pointer dereferences involving pscsi; review dmesg or syslog for entries referencing bio_kmalloc error paths; correlate with SCSI target activity.

What your security team should do

• Prioritize kernel updates on systems exposing SCSI target functionality.
• Review and restrict local access to hosts using pscsi until patched.
• Monitor kernel logs for bio_free related warnings as an indicator of exposure.
• Test patched kernels in staging environments before production rollout.