{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-26845", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-26845" ], "published": "2024-04-17T10:10:25Z", "summary": "scsi: target: core: Add TMF to tmr_list handling", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Add TMF to tmr_list handling\n\nAn abort that is responded to by iSCSI itself is added to tmr_list but does\nnot go to target core. A LUN_RESET that goes through tmr_list takes a\nrefcounter on the abort and waits for completion. However, the abort will\nbe never complete because it was not started in target core.\n\n Unable to locate ITT: 0x05000000 on CID: 0\n Unable to locate RefTaskTag: 0x05000000 on CID: 0.\n wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n...\n INFO: task kworker/0:2:49 blocked for more than 491 seconds.\n task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800\n Workqueue: events target_tmr_work [target_core_mod]\nCall Trace:\n __switch_to+0x2c4/0x470\n _schedule+0x314/0x1730\n schedule+0x64/0x130\n schedule_timeout+0x168/0x430\n wait_for_completion+0x140/0x270\n target_put_cmd_and_wait+0x64/0xb0 [target_core_mod]\n core_tmr_lun_reset+0x30/0xa0 [target_core_mod]\n target_tmr_work+0xc8/0x1b0 [target_core_mod]\n process_one_work+0x2d4/0x5d0\n worker_thread+0x78/0x6c0\n\nTo fix this, only add abort to tmr_list if it will be handled by target\ncore.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.80", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-26845" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/11f3fe5001ed05721e641f0ecaa7a73b7deb245d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/168ed59170de1fd7274080fe102216162d6826cf" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a9849b67b4402a12eb35eadc9306c1ef9847d53d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e717bd412001495f17400bfc09f606f1b594ef5a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/36bc5040c863b44af06094b22f1e50059227b9cb" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/83ab68168a3d990d5ff39ab030ad5754cbbccb25" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.5, "cvss_v3_severity": "High", "scenario": "AV:N - The vulnerable code is reached by iSCSI Task Management Function PDUs processed by the in-kernel LIO iSCSI target listening on TCP/3260, so a remote peer anywhere on the routable network can drive it. The same path is exported to other network fabrics (isert/RDMA, cxgbit).\nAC:L - The attacker fully controls both halves: an ABORT_TASK with a bogus RefTaskTag and out-of-window RefCmdSN parks a stale entry on dev_tmr_list, and an immediate-flagged LUN_RESET (which bypasses CmdSN sequencing) then walks that list. Using an out-of-order CmdSN keeps the stale entry alive indefinitely, so no race window has to be won.\nPR:N - Only an iSCSI session in full-feature phase is needed, and iSCSI login is unauthenticated in the standard SAN deployment (CHAP disabled, or generate_node_acls=1 demo mode) where the only \"credential\" is a plaintext IQN string that is discoverable via SendTargets and trivially spoofed.\nUI:N - The attacker sends two TMF PDUs on their own connection; no action by any administrator, initiator host, or local user is required.\nS:U - The deadlock is confined to the kernel's own target-core subsystem and its worker threads, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:N - The defect is an unbalanced completion wait on a TMR that never entered target core; no memory is read out of bounds and no kernel data is disclosed to the initiator.\nI:N - Nothing is written out of bounds and no freed object is reused \u2014 the reference count is held too long rather than dropped too early, so there is no corruption or control-flow primitive.\nA:H - The target_tmr_work kworker blocks forever in target_put_cmd_and_wait() and the iSCSI thread loops indefinitely in __transport_wait_for_tasks(), leaving unkillable D-state threads, a permanently pinned lun_ref that prevents LUN/device teardown, and a wedged storage target that only a reboot recovers; the hung-task detector can also panic the box." } } }