CVE-2024-26769: nvmet-fc: avoid deadlock on delete association path
In the Linux kernel, the following vulnerability has been resolved:
nvmet-fc: avoid deadlock on delete association path
The Linux kernel CVE team has assigned CVE-2024-26769 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040307-CVE-2024-26769-e9cc@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nvmet-fc: avoid deadlock on delete association path
When deleting an association the shutdown path is deadlocking because we try to flush the nvmetwq nested. Avoid this by deadlock by deferring the put work into its own work item.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.150 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.80 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.19 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Compensating control
Use the upstream fix approach for this issue: when deleting an association, avoid deadlocking in the shutdown path by deferring the "put" work into its own work item instead of flushing the nvmet_wq nested.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26769?
CVE-2024-26769 has been categorized based on its potential impact on system stability and security.
How do I fix CVE-2024-26769?
To address CVE-2024-26769, update the kernel to versions 5.15.150, 6.1.80, 6.6.19, 6.7.7, or 6.8 as appropriate.
What versions of the Linux kernel are affected by CVE-2024-26769?
CVE-2024-26769 affects certain kernel versions including those up to 5.15.150 and multiple versions of 6.x releases.
Is there a workaround for CVE-2024-26769?
Currently, the recommended approach to mitigate CVE-2024-26769 is updating to a patched kernel version.
What are the potential impacts of CVE-2024-26769?
CVE-2024-26769 may lead to system deadlocks if unmitigated, impacting system performance and availability.