CVE-2024-26760
A critical flaw in the Linux kernel's SCSI target pscsi driver causes a NULL pointer dereference when a bio allocation error is not handled correctly. This could allow an attacker to crash the system or potentially execute arbitrary code. The issue has been fixed in kernel commit 066ff571011d, so upgrading to a patched kernel resolves the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, particularly those running versions that lack the fix for commit 066ff571011d (the affected product list shows the 6.8 series).
Real-world impact
Exploitation could lead to a denial‑of‑service via kernel panic or, in some contexts, privilege escalation due to the NULL pointer dereference in the bio_free() path.
Why this severity
The CVSS v3.1 base score is 9.8 (Critical) because the vulnerability is network‑reachable, requires low attack complexity, no privileges or user interaction, and impacts confidentiality, integrity, and availability at the highest level.
What to do about it
- 01Obtain the patch for commit 066ff571011d from the Linux kernel source repository.
- 02Apply the patch to the affected kernel source.
- 03Recompile and install the updated kernel.
- 04Reboot the system to load the fixed kernel.
NVD description stating the vulnerability has been resolved.
Timeline
- Apr 3, 2024 · Apr 3, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 22h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.