cbcvebase.
CVE-2024-26845
published 2024-04-17

CVE-2024-26845: In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.73%
51.0th percentile
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core.

Affected

23 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < 11f3fe5001ed05721e641f0ecaa7a73b7deb245d11f3fe5001ed05721e641f0ecaa7a73b7deb245d
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < 168ed59170de1fd7274080fe102216162d6826cf168ed59170de1fd7274080fe102216162d6826cf
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < a9849b67b4402a12eb35eadc9306c1ef9847d53da9849b67b4402a12eb35eadc9306c1ef9847d53d
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < e717bd412001495f17400bfc09f606f1b594ef5ae717bd412001495f17400bfc09f606f1b594ef5a
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < 36bc5040c863b44af06094b22f1e50059227b9cb36bc5040c863b44af06094b22f1e50059227b9cb
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < bd508f96b5fef96d8a0ce9cbb211d82bcfc2341fbd508f96b5fef96d8a0ce9cbb211d82bcfc2341f
linuxlinux>= 2281c95fe751325874d135b237ecdcd3bc34cc26 < 83ab68168a3d990d5ff39ab030ad5754cbbccb2583ab68168a3d990d5ff39ab030ad5754cbbccb25
linuxlinux_kernel< 4.19.3084.19.308
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 0 < 5.4.0-186.2065.4.0-186.206
linuxlinux_kernel>= 0 < 5.15.0-112.1225.15.0-112.122
linuxlinux_kernel>= 4.20 < 5.4.2705.4.270
linuxlinux_kernel>= 5.11 < 5.15.1505.15.150
linuxlinux_kernel>= 5.16 < 6.1.806.1.80
linuxlinux_kernel>= 5.5 < 5.10.2115.10.211
linuxlinux_kernel>= 6.2 < 6.6.196.6.19
linuxlinux_kernel>= 6.7 < 6.7.76.7.7

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.