CVE-2024-26760

A flaw was found in the Linux kernel's SCSI (Small Computer System Interface) target subsystem. In specific error-handling scenarios during block input/output operations, the driver fails to properly release allocated request memory. A local user could exploit this flaw to trigger a null pointer dereference, resulting in a system crash and a Denial of Service (DoS).

This vulnerability is rated with Low severity for Red Hat Enterprise Linux because triggering the flaw requires administrative privileges to configure and execute pass-through SCSI target operations. The TCM/LIO SCSI pass-through target driver is not loaded by default and is only utilized in specialized storage host configurations. Because exploitation requires elevated local capabilities and cannot be leveraged for privilege escalation or unauthorized data access, the risk to standard deployments is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.