CVE-2024-46737

nvmet-tcp: fix kernel crash if commands allocation fails

State: Published
Severity: 7.5 High
Published: Sep 18, 2024
Updated: Aug 5, 2026
Reserved: Sep 11, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: fix kernel crash if commands allocation fails

If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference.

nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008

Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 03e1fd0327fa5e2174567f5fe9290fe21d21b8f4Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 50632b877ce55356f5d276b9add289b1e7ddc683Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 91dad30c5607e62864f888e735d0965567827bdfAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7957c731fc2b23312f8935812dee5a0b14b04e2dAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 489f2913a63f528cfe3f21722583fb981967ecdaAffected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 6c04d1e3ab22cc5394ef656429638a5947f87244Affected 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 5572a55a6f830ee3f3a994b6b962a5c327d28cb3Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.4.284 through 5.4.Not affected 5.10.226 through 5.10.Not affected 5.15.167 through 5.15.Not affected 6.1.110 through 6.1.Not affected 6.6.51 through 6.6.Not affected 6.10.10 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 03e1fd0327fa5e2174567f5fe9290fe21d21b8f4Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 50632b877ce55356f5d276b9add289b1e7ddc683Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 91dad30c5607e62864f888e735d0965567827bdfAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 7957c731fc2b23312f8935812dee5a0b14b04e2dAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 489f2913a63f528cfe3f21722583fb981967ecdaAffected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 6c04d1e3ab22cc5394ef656429638a5947f87244Affected
872d26a391da92ed8f0c0f5cb5fef428067b7f30 to before 5572a55a6f830ee3f3a994b6b962a5c327d28cb3Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.4.284 through 5.4.*Not affected
5.10.226 through 5.10.*Not affected
5.15.167 through 5.15.*Not affected
6.1.110 through 6.1.*Not affected
6.6.51 through 6.6.*Not affected
6.10.10 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.