CVE-2024-50183

MEDIUM4.7

scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance

Published Nov 8, 2024

Modified 1 weeks ago

No fix available

Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance

Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.

References

WEBhttps://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6 WEBhttps://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8 WEBhttps://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9 WEBhttps://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef WEBhttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2024-50183

CVSS Analysis

CVSS v3.1

4.7

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

4.7/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedNov 8, 2024

ModifiedJan 5, 2026