CVE-2024-35954

The bug is about a race condition in the Linux kernel's SCSI generic (sg) driver. The problem occurs during the removal of devices when the driver accesses a resource (request_queue) that may have already been freed, leading to a NULL pointer dereference. This issue can result in system crashes, impacting availability.

This vulnerability is evaluated with Moderate severity because exploitation requires local access during device teardown operations, confining the potential impact strictly to a system crash (denial of service). Under typical Red Hat Enterprise Linux deployments, non-privileged users cannot initiate SCSI device removal or detach hardware resources, which significantly constrains practical attack paths. The issue does not compromise data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.