CVE-2024-24855: Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()
A race condition was found in the Linux kernel's scsi device driver in lpfcunregisterfcfrescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
Apply the Linux kernel fix from commit id "0e881c0a4b614" to address the race condition in lpfc_unregister_fcf_rescan(), which can cause a null pointer dereference, kernel panic, or denial of service.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24855?
CVE-2024-24855 has a high severity due to its potential to cause kernel panic or denial of service.
How do I fix CVE-2024-24855?
To fix CVE-2024-24855, update your Linux kernel to version 6.12.11-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-24855?
CVE-2024-24855 affects Linux kernel versions from 2.6.34-rc1 up through 6.4.16.
What could happen if I do not address CVE-2024-24855?
Failing to address CVE-2024-24855 may lead to system instability and potential crashes.
Is CVE-2024-24855 a race condition vulnerability?
Yes, CVE-2024-24855 is a race condition vulnerability found in the Linux kernel's scsi device driver.