PT-2024-7889 · Linux+8 · Linux Kernel+8
Published
2024-03-10
·
Updated
2025-10-10
·
CVE-2024-26931
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 4.18.0-372.9.1.el8.x86 64
Description
The vulnerability is related to the qla2xxx component in the Linux kernel, which can cause a system crash due to a command failed to flush back to the SCSI layer. This occurs when the driver is under memory stress and unable to allocate an SRB to carry out error recovery of cable pull, leading to a null pointer dereference. The issue can be exploited to cause a denial of service.
Recommendations
To resolve the issue, update the Linux kernel to a version that includes the fix for the scsi: qla2xxx: Fix command flush on cable pull vulnerability. Specifically, update to a version later than 4.18.0-372.9.1.el8.x86 64.
Note: The provided information does not specify the exact version that includes the fix, so it is recommended to update to the latest available version.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu