Vulnerability identifier: #VU88101

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26627

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service attack (DoS).

The vulnerability exists due to improper locking when calling the scsi_host_busy() function. A local user can perform a denial of service attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/f5944853f7a961fedc1227dc8f60393f8936d37c
http://git.kernel.org/stable/c/d37c1c81419fdef66ebd0747cf76fb8b7d979059
http://git.kernel.org/stable/c/db6338f45971b4285ea368432a84033690eaf53c
http://git.kernel.org/stable/c/65ead8468c21c2676d4d06f50b46beffdea69df1
http://git.kernel.org/stable/c/07e3ca0f17f579491b5f54e9ed05173d6c1d6fcb
http://git.kernel.org/stable/c/4373534a9850627a2695317944898eb1283a2db0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.