CVE-2024-36952scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
- 4.7MediumCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric. Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch. Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent.
Timeline
ID reserved
By Linux
Published
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.
Affected products
- affected 92d7f7b0cde3ad2260e7462b40867b57efd49851 – < f2c7f029051edc4b394bb48edbe2297575abefe0
- affected 92d7f7b0cde3ad2260e7462b40867b57efd49851 – < 0936809d968ecf81e0726fbd02ff2a5732d960c3
- affected 92d7f7b0cde3ad2260e7462b40867b57efd49851 – < 76337eb8daee32bcc67742efab3168ed4ca299d0
- affected 92d7f7b0cde3ad2260e7462b40867b57efd49851 – < 718602cd15f4c5710850090ea3066a89eeb46278
- affected 92d7f7b0cde3ad2260e7462b40867b57efd49851 – < 4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c
- affected 2.6.23
- unaffected < 2.6.23
- unaffected 5.15.159 – ≤ 5.15.*
- unaffected 6.1.91 – ≤ 6.1.*
- unaffected 6.6.31 – ≤ 6.6.*
- unaffected 6.8.10 – ≤ 6.8.*
- unaffected 6.9 – ≤ *
References
References5
- https://git.kernel.org/stable/c/f2c7f029051edc4b394bb48edbe2297575abefe0 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/0936809d968ecf81e0726fbd02ff2a5732d960c3 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89eeb46278 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-36302 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-36952)Record last updated .