Riskcovery

CVE-2024-50183

scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance

State
Published
Severity
4.7 Medium
Published
Nov 8, 2024
Updated
May 11, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance

Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
LinuxLinux
  • 8ed190a91950564775cbaae9e8e8083a69a8da23 to before 0857b1c573c0b095aa778bb26d8b3378172471b6Affected
  • 8ed190a91950564775cbaae9e8e8083a69a8da23 to before 0ef6e016eb53fad6dc44c3253945efb43a3486b9Affected
  • 8ed190a91950564775cbaae9e8e8083a69a8da23 to before bbc525409bfe8e5bff12f5d18d550ab3e52cdbefAffected
  • 8ed190a91950564775cbaae9e8e8083a69a8da23 to before 0a3c84f71680684c1d41abb92db05f95c09111e8Affected
LinuxLinux
  • 5.17Affected
  • before 5.17Not affected
  • 6.1.113 through 6.1.*Not affected
  • 6.6.57 through 6.6.*Not affected
  • 6.11.4 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.