CVE-2024-50183

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50183

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.

References
Link Resource
https://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6 Patch
https://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8 Patch
https://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9 Patch
https://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 23:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

09 Dec 2024, 23:16

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6 - () https://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6 - Patch
References () https://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8 - () https://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8 - Patch
References () https://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9 - () https://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9 - Patch
References () https://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef - () https://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef - Patch
CWE CWE-362
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7

08 Nov 2024, 19:01

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: garantizar la finalización del manejo de DA_ID antes de eliminar una instancia de NPIV Eliminar una instancia de NPIV requiere que se liberen todos los ndlps de fabric antes de que se puedan eliminar los recursos de un NPIV. Si no se liberan los ndlps de fabric de antemano, se abren condiciones de ejecución por desequilibrio de kref. Se soluciona forzando a que DA_ID se complete de manera sincrónica con el uso de wait_queue.

08 Nov 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-08 06:15

Updated : 2025-11-03 23:16

NVD link : CVE-2024-50183

Mitre link : CVE-2024-50183

CVE.ORG link : CVE-2024-50183

JSON object : View

Products Affected

linux

CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')