CVE-2024-50183

low-risk
Published 2024-11-08

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.7/10 Medium
LOCAL / HIGH complexity

Affected Products (1)

Affected Vendors

Linux

References (5)

Patch https://git.kernel.org/stable/c/0857b1c573c0b095aa778bb26d8b3378172471b6
Patch https://git.kernel.org/stable/c/0a3c84f71680684c1d41abb92db05f95c09111e8
Patch https://git.kernel.org/stable/c/0ef6e016eb53fad6dc44c3253945efb43a3486b9
Patch https://git.kernel.org/stable/c/bbc525409bfe8e5bff12f5d18d550ab3e52cdbef
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
17
/ 100
low-risk
Severity 12/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal