CVE-2024-50183

A flaw was found in the Linux kernel. When deleting an N_Port ID Virtualization (NPIV) instance, the system does not ensure that all associated fabric network device link protocols (ndlps) are released synchronously. This can lead to a kernel reference count (kref) imbalance race condition, which a local attacker could potentially exploit to cause a denial of service by crashing the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Emulex LightPulse Fibre Channel adapters are not in use on the system, the lpfc kernel module can be prevented from loading to mitigate this vulnerability. To blacklist the lpfc module, create a file /etc/modprobe.d/blacklist-lpfc.conf with the content blacklist lpfc. Regenerate the initramfs using dracut -f -v or mkinitrd -f -v and reboot the system. This action may impact system functionality if Emulex Fibre Channel adapters are required.