medium 4.4

CVE-2024-26846 json

nvme-fc: do not wait in vain when unloading module

published 2024-04-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-24108

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit.

There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever.

If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary. We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue.

While at it, remove the unused nvme_fc_wq workqueue too.

Patch / fix

fixed in 1 distros 6 links 6

Linux Linux 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8

debian ubuntu red hat suse almalinux rocky linux

linux Debian 12 6.1.82-1
linux Debian 14, Debian 13 6.7.7-1

debian advisories DEBIAN-CVE-2024-26846

linux Ubuntu 22.04 LTS 5.15.0-112.122
linux-aws Ubuntu 22.04 LTS 5.15.0-1063.69
linux-gcp Ubuntu 22.04 LTS 5.15.0-1062.70
linux-gke Ubuntu 22.04 LTS 5.15.0-1060.66
linux-ibm Ubuntu 22.04 LTS 5.15.0-1056.59
linux-kvm Ubuntu 22.04 LTS 5.15.0-1060.65
linux-azure Ubuntu 22.04 LTS 5.15.0-1066.75
linux-gkeop Ubuntu 22.04 LTS 5.15.0-1046.53

ubuntu advisories UBUNTU-CVE-2024-26846

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-503.11.1.el9_5
rv RHEL 9 5.14.0-503.11.1.el9_5
perf RHEL 9 5.14.0-503.11.1.el9_5
rtla RHEL 9 5.14.0-503.11.1.el9_5
bpftool RHEL 9 7.4.0-503.11.1.el9_5
libperf RHEL 9 5.14.0-503.11.1.el9_5
kernel-rt RHEL 9 5.14.0-503.11.1.el9_5
kernel-64k RHEL 9 5.14.0-503.11.1.el9_5

red hat advisories RHSA-2025:2270 RHSA-2024:9315 RHSA-2024:7000

kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-livepatch-MICRO-6-0-RT_Update_5 Linux Micro 6.1, Linux Micro 6.0 1-1.1
kernel-rt Linux Micro 6.0 6.4.0-9.1
kernel-source-rt Linux Micro 6.0 6.4.0-9.1
kernel-source Linux Micro 6.0 6.4.0-18.1
kernel-default Linux Micro 6.0 6.4.0-18.1
kernel-kvmsmall Linux Micro 6.0 6.4.0-18.1

suse advisories SUSE-SU-2025:20166-1 SUSE-SU-2025:20249-1 SUSE-SU-2025:20028-1 SUSE-SU-2025:20008-1 SUSE-SU-2024:2973-1 SUSE-SU-2024:2203-1

kernel AlmaLinux 8 4.18.0-553.22.1.el8_10
perf AlmaLinux 8 4.18.0-553.22.1.el8_10
bpftool AlmaLinux 8 4.18.0-553.22.1.el8_10
kernel-core AlmaLinux 8 4.18.0-553.22.1.el8_10
kernel-tools AlmaLinux 8 4.18.0-553.22.1.el8_10
python3-perf AlmaLinux 8 4.18.0-553.22.1.el8_10
kernel-modules AlmaLinux 8 4.18.0-553.22.1.el8_10
kernel-zfcpdump AlmaLinux 8 4.18.0-553.22.1.el8_10

almalinux advisories ALSA-2024:7000

kernel Rocky Linux 8 4.18.0-553.22.1.el8_10

rocky linux advisories RLSA-2024:7000

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-26846 updated 2026-11-07 cvss 4.4

kernel: nvme-fc: do not wait in vain when unloading module

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +6 more
affected: no fix available
Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-s390x 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-x86_64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-aarch64 5.14.0-503.11.1.el9_5, kernel-debuginfo-common-ppc64le 5.14.0-503.11.1.el9_5
fixed: vendor fix RHSA-2024:9315
Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.57.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.57.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.57.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.57.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.57.1.el9_4
fixed: vendor fix RHSA-2025:2270
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-503.11.1.el9_5, perf 5.14.0-503.11.1.el9_5, rtla 5.14.0-503.11.1.el9_5, kernel-devel-matched 5.14.0-503.11.1.el9_5, kernel-64k-devel-matched 5.14.0-503.11.1.el9_5, kernel-debug-devel-matched 5.14.0-503.11.1.el9_5, +6 more
fixed: vendor fix RHSA-2024:9315
Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.57.1.el9_4, perf 5.14.0-427.57.1.el9_4, rtla 5.14.0-427.57.1.el9_4, kernel-devel-matched 5.14.0-427.57.1.el9_4, kernel-64k-devel-matched 5.14.0-427.57.1.el9_4, kernel-debug-devel-matched 5.14.0-427.57.1.el9_4, +6 more
fixed: vendor fix RHSA-2025:2270
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.22.1.el8_10, kernel 4.18.0-553.22.1.el8_10, bpftool 4.18.0-553.22.1.el8_10, kernel-core 4.18.0-553.22.1.el8_10, kernel-tools 4.18.0-553.22.1.el8_10, python3-perf 4.18.0-553.22.1.el8_10, +15 more
fixed: vendor fix RHSA-2024:7000
Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.4.0-503.11.1.el9_5, kernel 5.14.0-503.11.1.el9_5, kernel-64k 5.14.0-503.11.1.el9_5, kernel-core 5.14.0-503.11.1.el9_5, kernel-tools 5.14.0-503.11.1.el9_5, python3-perf 5.14.0-503.11.1.el9_5, +29 more
fixed: vendor fix RHSA-2024:9315

show 8 more

Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.57.1.el9_4, kernel 5.14.0-427.57.1.el9_4, kernel-64k 5.14.0-427.57.1.el9_4, kernel-core 5.14.0-427.57.1.el9_4, kernel-tools 5.14.0-427.57.1.el9_4, python3-perf 5.14.0-427.57.1.el9_4, +28 more
fixed: vendor fix RHSA-2025:2270
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.22.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.22.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.22.1.el8_10
fixed: vendor fix RHSA-2024:7000
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, kernel-rt-modules-core 5.14.0-503.11.1.el9_5, kernel-rt-debug-modules 5.14.0-503.11.1.el9_5, +4 more
fixed: vendor fix RHSA-2024:9315
Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.57.1.el9_4, kernel-rt-core 5.14.0-427.57.1.el9_4, kernel-rt-modules 5.14.0-427.57.1.el9_4, kernel-rt-debug-core 5.14.0-427.57.1.el9_4, kernel-rt-modules-core 5.14.0-427.57.1.el9_4, kernel-rt-debug-modules 5.14.0-427.57.1.el9_4, +4 more
fixed: vendor fix RHSA-2025:2270
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-503.11.1.el9_5, kernel-rt-kvm 5.14.0-503.11.1.el9_5, kernel-rt-core 5.14.0-503.11.1.el9_5, kernel-rt-modules 5.14.0-503.11.1.el9_5, kernel-rt-debug-kvm 5.14.0-503.11.1.el9_5, kernel-rt-debug-core 5.14.0-503.11.1.el9_5, +6 more
fixed: vendor fix RHSA-2024:9315
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.57.1.el9_4, kernel-rt-kvm 5.14.0-427.57.1.el9_4, kernel-rt-core 5.14.0-427.57.1.el9_4, kernel-rt-modules 5.14.0-427.57.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.57.1.el9_4, kernel-rt-debug-core 5.14.0-427.57.1.el9_4, +6 more
fixed: vendor fix RHSA-2025:2270
Red Hat OpenShift AI 8 rhoai/odh-rhel8-operator v2.13.1-2, rhoai/odh-dashboard-rhel8 v2.13.1-1, rhoai/odh-modelmesh-rhel8 v2.13.1-1, rhoai/odh-operator-bundle v2.13.1-2, rhoai/odh-rhel8-operator v2.14.0-24, rhoai/odh-dashboard-rhel8 v2.14.0-11, +56 more
fixed: vendor fix RHBA-2024:8413
Red Hat CodeReady Linux Builder (v. 9) kernel-cross-headers 5.14.0-503.11.1.el9_5 Red Hat Enterprise Linux AppStream (v. 9) kernel-headers 5.14.0-503.11.1.el9_5
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-04-19)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-415 Double Free

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /stable/c/4f2c95015ec2a1899161be6c0bdaecedd5a7bfb2
patch
git.kernel.org /stable/c/0bf567d6d9ffe09e059bbdfb4d07143cef42c75c
patch
git.kernel.org /stable/c/085195aa90a924c79e35569bcdad860d764a8e17
patch
git.kernel.org /stable/c/baa6b7eb8c66486bd64608adc63fe03b30d3c0b9
patch
git.kernel.org /stable/c/c0882c366418bf9c19e1ba7f270fe377a9bf5d67
patch
git.kernel.org /stable/c/70fbfc47a392b98e5f8dba70c6efc6839205c982
patch
lists.debian.org /debian-lts-announce/2024/06/msg00017.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2024-26846
NVD CVE-2024-26846

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary