CVE-2024-49891

A flaw was found in the scsi: lpfc component of the Linux kernel. When a Host Bus Adapter (HBA) undergoes a reset or handles an errata event, it can lead to a null pointer dereference. This occurs because hdwq pointers may be freed and then improperly accessed, potentially causing system crashes. This vulnerability could result in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Emulex LightPulse Fibre Channel HBAs are not in use, the lpfc kernel module can be blacklisted to prevent it from loading. Create a file /etc/modprobe.d/blacklist-lpfc.conf with the content blacklist lpfc. A system reboot is required for this change to take effect. This may impact functionality if Fibre Channel HBAs are required.