CVE-2024-50183: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
First published: Fri Nov 08 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | <6.1.113 | |
| Linux Kernel | >=6.2<6.6.57 | |
| Linux Kernel | >=6.7<6.11.4 | |
| debian/linux | <=5.10.223-1<=5.10.226-1 | 6.1.123-1 6.1.128-1 6.12.12-1 6.12.15-1 |
| debian/linux-6.1 | 6.1.119-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6
- https://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9
- https://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef
- https://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50183
- https://nvd.nist.gov/vuln/detail/CVE-2024-50183
- https://launchpad.net/bugs/cve/CVE-2024-50183
- https://security-tracker.debian.org/tracker/CVE-2024-50183
- https://ubuntu.com/security/CVE-2024-50183
- https://git.kernel.org/linus/0a3c84f71680684c1d41abb92db05f95c09111e8
Frequently Asked Questions
What is the severity of CVE-2024-50183?
CVE-2024-50183 has a severity rating that needs to be evaluated based on its impact on system security and functionality.
How do I fix CVE-2024-50183?
To fix CVE-2024-50183, ensure your Linux kernel is updated to a version beyond 6.1.113 or between 6.2 and 6.6.57, or between 6.7 and 6.11.4.
Which Linux kernel versions are affected by CVE-2024-50183?
CVE-2024-50183 affects Linux kernel versions prior to 6.1.113, versions between 6.2 and 6.6.57, and versions between 6.7 and 6.11.4.
What components are vulnerable in CVE-2024-50183?
CVE-2024-50183 specifically targets the SCSI LPFC driver within the Linux kernel.
What are the implications of CVE-2024-50183?
The implications of CVE-2024-50183 include potential resource management issues when deleting NPIV instances which could affect system stability.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.2
- version/linux kernel/6.7
- package-manager/debian