Fix tag leaks on error in scsi: pm8001

Kernel Updated 02 Oct 2025

Summary

24/04/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1002007: scsi: pm8001: Fix tag leaks on error. Affects Kernel versions < a0bb65eadbf942024226241d9d99fed17168940b. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The scsi: pm8001 package is a SCSI host bus adapter driver for the PM8001 SAS/SATA controller. It provides support for managing SCSI devices connected to the controller. The vulnerability in this package allows for tag leaks on error, which can lead to potential security risks.

Vulnerability Detail

The vulnerability in scsi: pm8001 occurs when there is an error in the handling of tags. Tags are used to identify and track commands sent to SCSI devices. When an error occurs, tags may not be properly released, leading to tag leaks. This can result in resource exhaustion and potential denial-of-service attacks. The vulnerability has been fixed in Linux Kernel version v5.10.111 by commit a0bb65eadbf942024226241d9d99fed17168940b.

How To Fix

No fixed version is published for this vulnerability.

To fix the vulnerability, it is recommended to update the scsi: pm8001 package to the latest version, which includes the fix. The fix is available in Linux Kernel version v5.10.111 or later. You can obtain the updated package from the official Linux Kernel repository.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The scsi: pm8001 package is vulnerable to tag leaks on error, which can result in resource exhaustion and potential denial-of-service attacks. It is recommended to update the package to the latest version, available in Linux Kernel version v5.10.111 or later, to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for Kernel →