CVE-2017-12190: Linux Kernel

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.

Affected products

• Linux Linux Kernel: up to and including 4.13.7

Published 2017-11-22. Last modified 2026-06-17.