CVE-2024-50026: scsi: wd33c93: Don't use stale scsi_pointer value
In the Linux kernel, the following vulnerability has been resolved:
scsi: wd33c93: Don't use stale scsipointer value
A regression was introduced with commit dbb2da557a6a ("scsi: wd33c93: Move the SCSI pointer to private command data") which results in an oops in wd33c93intr(). That commit added the scsipointer variable and initialized it from hostdata->connected. However, during selection, hostdata->connected is not yet valid. Fix this by getting the current scsipointer from hostdata->selecting.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50026?
CVE-2024-50026 has been classified as a security vulnerability within the Linux kernel.
How do I fix CVE-2024-50026?
To fix CVE-2024-50026, you should upgrade to the latest patched version of the Linux kernel, including versions such as 5.10.223-1 or 6.12.15-1.
What systems are affected by CVE-2024-50026?
CVE-2024-50026 impacts various versions of the Linux kernel, specifically versions between 5.18 and 6.6.57 and several pre-release versions.
Is there a workaround for CVE-2024-50026?
Currently, there are no known workarounds for CVE-2024-50026; upgrading the kernel is the recommended course of action.
What does CVE-2024-50026 potentially allow an attacker to do?
CVE-2024-50026 can lead to a system crash due to an oops in wd33c93_intr(), affecting the stability of systems using the vulnerable kernel versions.