CVE-2024-35954 is a vulnerability in the Linux kernel's SCSI generic (sg) subsystem where the function sg_remove_sfp_usercontext() calls sg_device_destroy() after scsi_device_put(). The call to scsi_device_put() can remove the last reference to the parent scsi_device, setting its request_queue pointer to NULL. Subsequently, sg_device_destroy() accesses this now NULL request_queue, causing a NULL pointer dereference that crashes the kernel. This is classified as a CWE-476 (NULL Pointer Dereference) issue. The vulnerability has a CVSS 3.1 base score of 4.7 (medium severity) with local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but causes availability impact due to kernel crash.

Exploitation of this vulnerability results in a NULL pointer dereference that crashes the Linux kernel, causing a denial of service (system crash). There is no impact on confidentiality or integrity. The attack requires local access with low privileges and is of high complexity, limiting the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel-level issue, applying the official Linux kernel updates when available is recommended. Until a patch is released, avoid untrusted local code execution that could trigger this race condition.