CVE-2021-47258
MEDIUMLinux Kernel < 4.9.273 - Use-After-Free in SCSI Host Device Initialization
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.
References (7)
Core 7
Core References
Scores
CVSS v3
5.5
EPSS
0.0024
EPSS Percentile
14.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-401
Status
published
Products (18)
Linux/Linux
< 2.6.30
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 45d83db4728127944b237c0c8248987df9d478e7
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 66a834d092930cf41d809c0e989b13cd6f9ca006
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 79296e292d67fa7b5fb8d8c27343683e823872c8
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 7a696ce1d5d16a33a6cd6400bbcc0339b2460e11
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - 8958181c1663e24a13434448e7d6b96b5d04900a
Linux/Linux
1fa5ae857bb14f6046205171d98506d8112dd74e - db08ce595dd64ea9859f7d088b51cbfc8e685c66
Linux/Linux
2.6.30
Linux/Linux
4.14.237 - 4.14.*
... and 8 more
Published
May 21, 2024
Tracked Since
Feb 18, 2026