7.5

CVE-2024-26845: debian debian_linux

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2024-26845DEBIAN-CVE-2024-26845
Published 17-04-2024Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2024-26845 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.74%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 23
DLA-3840-1DLA-3842-1DSA-5681-1SUSE-SU-2024:2360-1SUSE-SU-2024:2372-1SUSE-SU-2024:2381-1

Timeline

  1. 17-04-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.01 pp

From 0.73% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu117 products
  • linuxAll versions (No fix recorded) | < 5.4.0-186.206 | < 5.15.0-112.122
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1126.136 | < 5.15.0-1063.69
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < 11f3fe5001ed05721e641f0ecaa7a73b7deb245d | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < 168ed59170de1fd7274080fe102216162d6826cf | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < a9849b67b4402a12eb35eadc9306c1ef9847d53d | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < e717bd412001495f17400bfc09f606f1b594ef5a | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < 36bc5040c863b44af06094b22f1e50059227b9cb | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f | ≥ 2281c95fe751325874d135b237ecdcd3bc34cc26, < 83ab68168a3d990d5ff39ab030ad5754cbbccb25 | 5.1
  • linux_kernel< 4.19.308 | ≥ 4.20, < 5.4.270 | ≥ 5.5, < 5.10.211 | ≥ 5.11, < 5.15.150 | ≥ 5.16, < 6.1.80 | ≥ 6.2, < 6.6.19 | ≥ 6.7, < 6.7.7

3 vendors · 121 products

References

26 links
Show all 26 references