LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux iSCSI target handling can leave storage-management work waiting indefinitely, tying up a kernel worker and disrupting availability. It affects systems using vulnerable Linux kernels as SCSI/iSCSI targets; ordinary Linux hosts not providing this function are less likely to be exposed.

Executive priority

Prioritize affected storage target servers because successful triggering could disrupt storage availability without authentication. Accelerate patching where iSCSI is reachable from untrusted or broad networks. Lower priority for systems demonstrably not operating as SCSI/iSCSI targets, while still following normal kernel maintenance.

Technical view

An iSCSI-handled abort can be added to target core's task-management list without entering target core. A later LUN_RESET takes a reference to that abort and waits for completion that never occurs, leaving target_tmr_work blocked. The upstream correction only adds aborts to the list when target core will handle them.

Likely exposure

Focus on Linux systems providing network-accessible iSCSI or SCSI target services with affected kernel builds. Exposure depends on deployed kernel lineage, backported vendor fixes, target modules, and reachability. The supplied version data is ambiguously encoded, so package-level vendor verification is necessary.

Exploitation context

The CVSS 3.1 score is 7.5, describing network-reachable, low-complexity, unauthenticated availability impact. The bundle marks KEV false and provides no evidence of active exploitation or a public weaponized exploit. Treat practical exploitability as unconfirmed.

Researcher notes

The failure is a task-management reference/completion mismatch involving an abort handled within iSCSI and a subsequent LUN_RESET processed through tmr_list. The evidence demonstrates a prolonged blocked kernel worker, not confidentiality or integrity loss. Exact vulnerable package ranges require distribution-specific analysis because the supplied affected-version representation is unclear.

Mitigation direction

  • Install a supported vendor kernel containing the applicable referenced upstream correction.
  • Check distribution security guidance because vendors may backport fixes without changing to an obvious upstream version.
  • Prioritize remediation on production iSCSI target hosts and other availability-sensitive storage infrastructure.
  • If immediate updating is impossible, request a vendor-approved workaround; the supplied sources name none.

Validation and detection

  • Inventory kernel versions and distribution package revisions on systems providing storage target services.
  • Confirm whether iSCSI target and Linux target-core functionality are enabled and reachable.
  • Map each deployed kernel package against its vendor advisory and applicable upstream stable fix.
  • Review kernel logs for blocked target_tmr_work workers, LUN_RESET waits, or task-tag lookup failures.
  • After updating, verify the running kernel contains the vendor backport or referenced correction.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26845 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2024-26845Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26, 2281c95fe751325874d135b237ecdcd3bc34cc26unaffected
LinuxLinux5.1, 0, 5.4.270, 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.