VYPR
← All advisories
High severity7.8NVD Advisory· Published Dec 27, 2024· Updated May 12, 2026

CVE-2024-56631

CVE-2024-56631

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Fix slab-use-after-free read in sg_release()

Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:

BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407

In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp.

After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error.

Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures:

- No references to sfp or sdp occur after the reference count is decremented.

- Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release().

The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free in Linux kernel's SCSI generic (sg) driver occurs when sg_release() references freed memory due to incorrect mutex unlocking order.

Vulnerability

Overview

CVE-2024-56631 is a high-severity use-after-free vulnerability in the Linux kernel's SCSI generic (sg) driver, specifically in the sg_release() function. The root cause is an improper ordering of operations: the function calls kref_put(&sfp->f_ref, sg_remove_sfp) before releasing the open_rel_lock mutex. This kref_put() can decrement the reference count of the sfp structure to zero, triggering its cleanup via sg_remove_sfp(), which eventually frees sfp. After that, sg_release() continues to unlock the mutex and may reference the already-freed sfp or sdp, resulting in a slab-use-after-free condition [1][2].

Attack

Vector and Exploitation

The vulnerability is triggered during the release of an open file descriptor on a SCSI generic device. An attacker with local access and the ability to open and close such a device can exploit this race condition. The flaw was identified by syzbot using KASAN (Kernel Address Sanitizer), which detected the use-after-free in lock_release and __mutex_unlock_slowpath [1]. No special privileges beyond basic file access to /dev/sg* devices are required, making this a locally exploitable bug.

Impact

Successful exploitation can lead to memory corruption, potentially allowing an attacker to crash the system (denial of service) or, in more severe scenarios, escalate privileges by leveraging the use-after-free to execute arbitrary code in kernel context. The CVSS v3 score of 7.8 reflects this high impact on confidentiality, integrity, and availability.

Mitigation

The fix, already merged into the Linux kernel stable branches, moves the kref_put() call to after the mutex unlock, ensuring no references to sfp or sdp are made after the reference count is decremented [1][2]. Users are advised to apply the latest kernel updates from their distribution. Siemens also lists this CVE as affecting SIMATIC S7-1500 TM MFP devices running an embedded GNU/Linux subsystem [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

199

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.