CVE-2024-26846: nvme-fc: do not wait in vain when unloading module

Published Apr 17, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: do not wait in vain when unloading module

The Linux kernel CVE team has assigned CVE-2024-26846 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041717-CVE-2024-26846-9593@gregkh/T

Other sources

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: do not wait in vain when unloading module

The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvmedeletectrl and idadestroy has been added by the initial commit.

There is some logic around trying to prevent from hanging forever in waitforcompletion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever.

If we completely rely on the cleanup code executed from the nvmedeletectrl path, all IDs will be freed eventually. This makes calling idadestroy unnecessary. We only have to ensure that all nvmedeletectrl code has been executed before we leave nvmefcexitmodule. This is done by flushing the nvmedeletewq workqueue.

While at it, remove the unused nvmefcwq workqueue too.

— NVD

Affected Software

15 affected componentsFixes available
redhat/kernel<5.10.211
5.10.211
redhat/kernel<5.15.150
5.15.150
redhat/kernel<6.1.80
6.1.80
redhat/kernel<6.6.19
6.6.19
redhat/kernel<6.7.7
6.7.7
redhat/kernel<6.8
6.8
Linux Linux kernel<5.10.211
Linux Linux kernel>=5.11<5.15.150
Linux Linux kernel>=5.16<6.1.80
Linux Linux kernel>=6.2<6.6.19
Linux Linux kernel>=6.7<6.7.7
Linux Linux kernel=6.8-rc1
Linux Linux kernel=6.8-rc2
Debian Debian Linux=10.0
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.10.211
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.15.150
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.1.80
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.6.19
  6. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.7.7
  7. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.8

Event History

Apr 17, 2024
CVE Published
via MITRE·10:10 AM
Data Sourced
via MITRE·10:10 AM
Description
Data Sourced
via Red Hat·03:48 PM
DescriptionSeverityAffected Software
Jun 8, 2024
Data Sourced
via Launchpad·01:07 AM
Description
May 6, 2025
Data Sourced
via Ubuntu·02:22 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-26846?

CVE-2024-26846 has been classified as a medium severity vulnerability in the Linux kernel.

2

How do I fix CVE-2024-26846?

To fix CVE-2024-26846, users should upgrade to the latest kernel versions provided by their system’s package manager as specified in the advisory.

3

What are the affected Linux kernel versions for CVE-2024-26846?

CVE-2024-26846 affects several versions of the Linux kernel including 5.10.211, 5.15.150, 6.1.80, and 6.6.19.

4

Is CVE-2024-26846 a patchable vulnerability?

Yes, CVE-2024-26846 is patchable and users are encouraged to apply the relevant updates.

5

What types of systems are vulnerable to CVE-2024-26846?

Vulnerable systems include those running affected versions of the Linux kernel, particularly on Red Hat and Debian distributions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203