PT-2024-9074 · Linux+10 · Linux Kernel+10
Published
2024-03-10
·
Updated
2026-03-14
·
CVE-2024-36952
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a race condition in the Linux kernel's lpfc component, specifically in the
lpfc vport delete() function. This occurs when a vport is unregistered before the Remove All DA ID CT and LOGO ELS are sent to the fabric, causing the fabric switch to still believe the NPIV is logged into the fabric. The fc remove host() function, which calls dev loss tmo for all D IDs including the fabric D ID, removes the last ndlp reference and frees the ndlp rport object, sometimes causing the final DA ID and LOGO to be skipped from being sent to the fabric switch.Recommendations:
To resolve the issue, move the
fc remove host() and scsi remove host() calls after DA ID and LOGO are sent.
As a temporary workaround, consider disabling the lpfc vport delete() function until a patch is available.
Update to a newer version of the Linux kernel, such as version 6.6.37, which fixes bugs and vulnerabilities.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu