CVE-2024-46842

A flaw was found in the Linux kernel's scsi: lpfc module. When handling mailbox timeouts in the lpfc_get_sfp_info routine, the system may attempt to use memory that has already been released. This use-after-free vulnerability could allow a local attacker to cause a denial of service, leading to system instability or crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the lpfc kernel module from loading. This can be achieved by creating a blacklist entry and regenerating the initramfs.

1. Create a blacklist file: echo "blacklist lpfc" | sudo tee /etc/modprobe.d/blacklist-lpfc.conf
2. Regenerate the initramfs: sudo dracut -f -v (for systems using dracut) or sudo mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r) (for systems using mkinitrd)

A system reboot is required for the changes to take effect. Disabling this module may impact systems relying on Emulex Fibre Channel adapters for storage access.