CVE-2021-47258: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.

Affected products

• Linux Linux Kernel: before 4.9.273 (fixed in 4.9.273); from 4.10, before 4.14.237 (fixed in 4.14.237); from 4.15, before 4.19.195 (fixed in 4.19.195); from 4.20, before 5.4.126 (fixed in 5.4.126); from 5.5, before 5.10.44 (fixed in 5.10.44); from 5.11, before 5.12.11 (fixed in 5.12.11); …

Published 2024-05-21. Last modified 2026-06-17.