scsi: target: core: Fix null-ptr-deref in target_alloc_device()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.229, 5.15.170, 6.1.115, 6.11.6, 6.6.59
- CVEs
- CVE-2024-50153
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 17:51 UTC · Revision 1
Source evidence
scsi: target: core: Fix null-ptr-deref in target_alloc_device()
core-osv · Original sourcePublished 7 Nov 2024, 09:31 UTC
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().
osv:CVE-2024-50153
Kernel
Fixed versions: 5.10.229, 5.15.170, 6.1.115, 6.6.59, 6.11.6
Complete source record
{
"id": "aa7dd5142ee51661cba8d5193b489e9decf09a2a28ec1107e54ac264b4a72517",
"url": "https://osv.dev/vulnerability/CVE-2024-50153",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "scsi: target: core: Fix null-ptr-deref in target_alloc_device()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0 ... entry_SYSCALL_64_after_hwframe+0x76/0x7e In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem. Fixing this bug by freeing dev with hba->backend->ops->free_device().",
"evidence": "osv:CVE-2024-50153",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.229",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.170",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.115",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.59",
"evidence": "/affected/1/ranges"
},
{
"value": "6.11.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "CVE-2024-50153",
"aliases": [
"CVE-2024-50153"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "008b936bbde3e87a611b3828a0d5d2a4f99026a0"
},
{
"fixed": "8c1e6717f60d31f8af3937c23c4f1498529584e1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1526d9f10c6184031e42afad0adbdde1213e8ad1"
},
{
"fixed": "39e02fa90323243187c91bb3e8f2f5f6a9aacfc7"
},
{
"fixed": "895ab729425ef9bf3b6d2f8d0853abe64896f314"
},
{
"fixed": "b80e9bc85bd9af378e7eac83e15dd129557bbdb6"
},
{
"fixed": "14a6a2adb440e4ae97bee73b2360946bd033dadd"
},
{
"fixed": "fca6caeb4a61d240f031914413fcc69534f6dc03"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.180"
},
{
"fixed": "5.10.229"
}
]
}
],
"versions": [
"v5.10.228",
"v5.10.227",
"v5.10.226",
"v5.10.225",
"v5.10.224",
"v5.10.223",
"v5.10.222",
"v5.10.221",
"v5.10.220",
"v5.10.219",
"v5.10.218",
"v5.10.217",
"v5.10.216",
"v5.10.215",
"v5.10.214",
"v5.10.213",
"v5.10.212",
"v5.10.211",
"v5.10.210",
"v5.10.209",
"v5.10.208",
"v5.10.207",
"v5.10.206",
"v5.10.205",
"v5.10.204",
"v5.10.203",
"v5.10.202",
"v5.10.201",
"v5.10.200",
"v5.10.199",
"v5.10.198",
"v5.10.197",
"v5.10.196",
"v5.10.195",
"v5.10.194",
"v5.10.193",
"v5.10.192",
"v5.10.191",
"v5.10.190",
"v5.10.189",
"v5.10.188",
"v5.10.187",
"v5.10.186",
"v5.10.185",
"v5.10.184",
"v5.10.183",
"v5.10.182",
"v5.10.181",
"v5.10.180"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50153.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.10.229"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.170"
},
{
"fixed": "6.1.115"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.6.59"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.11.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50153.json"
}
}
],
"modified": "2026-10-28T02:30:22.132236617Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
"https://git.kernel.org/stable/c/14a6a2adb440e4ae97bee73b2360946bd033dadd",
"https://git.kernel.org/stable/c/39e02fa90323243187c91bb3e8f2f5f6a9aacfc7",
"https://git.kernel.org/stable/c/895ab729425ef9bf3b6d2f8d0853abe64896f314",
"https://git.kernel.org/stable/c/8c1e6717f60d31f8af3937c23c4f1498529584e1",
"https://git.kernel.org/stable/c/b80e9bc85bd9af378e7eac83e15dd129557bbdb6",
"https://git.kernel.org/stable/c/fca6caeb4a61d240f031914413fcc69534f6dc03",
"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50153.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-50153",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50153.json"
}
},
"related_cves": [
{
"value": "CVE-2024-50153",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 487957,
"published_at": "2024-11-07T09:31:29.791+00:00"
}