CVE-2024-26931 in Linux
Summary
by MITRE • 05/01/2024
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
System crash due to command failed to flush back to SCSI layer.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI
CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]
RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]
qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0
? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]
qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.
? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]
qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1
? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]
qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0
? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.
? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70
? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8
? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.
? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout
The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL.
Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/26/2026
The vulnerability identified as CVE-2024-26931 affects the Linux kernel's qla2xxx SCSI driver, specifically within the NVMe over Fabrics (NVMe_FC) subsystem. This issue manifests as a system crash due to a NULL pointer dereference when handling command flush operations during cable removal events. The flaw occurs in the context of SCSI command processing where the driver fails to properly flush outstanding commands back to the SCSI layer when a fiber channel connection is lost. The kernel oops trace indicates that the crash originates from the __wake_up_common function, which attempts to access a NULL pointer at address zero, suggesting that a command structure or related data structure has been improperly deallocated or not initialized correctly during the command flush process. The system's memory stress conditions exacerbate this issue by preventing the driver from allocating necessary SRB (SCSI Request Block) structures required for error recovery operations.
The root cause of this vulnerability stems from improper handling of command flush operations during session teardown in the qla2xxx driver. When a cable is pulled, the driver must flush all pending SCSI commands back to the upper layer for proper cleanup. However, under memory pressure conditions, the driver fails to allocate necessary resources for this flush operation, leading to commands remaining in an inconsistent state. During subsequent cable pull events, when memory becomes available again, the driver attempts to flush commands that have already been partially deallocated or corrupted, resulting in access to NULL pointers. This behavior represents a classic race condition and resource management flaw that violates standard kernel memory management practices and can lead to system instability and potential denial of service conditions.
The operational impact of this vulnerability is significant for enterprise storage environments relying on fiber channel infrastructure, particularly those using HPE ProLiant servers with qla2xxx HBAs. The vulnerability can cause unexpected system crashes during normal cable management operations, leading to service disruption and potential data loss. The crash occurs during the command flush process when the system attempts to DMA unmap an SGL (Scatter-Gather List) that has already been freed or corrupted, creating a NULL pointer dereference that triggers a kernel oops and system panic. This issue affects systems running kernel versions including 4.18.0-372.9.1.el8.x86_64 and potentially other versions where the qla2xxx driver fails to properly manage command lifecycle during session teardown operations.
The fix implemented addresses this vulnerability by adding a preventive check to ensure that commands are properly flushed back to the SCSI layer during session teardown operations. This mitigation prevents the NULL pointer access that occurs when the driver attempts to access deallocated command structures. The solution follows established security practices for kernel memory management and command queue handling, ensuring that all pending commands are properly cleaned up before session resources are released. The fix aligns with CWE-476, which addresses NULL pointer dereference vulnerabilities, and implements defensive programming techniques to prevent resource state corruption during concurrent operations. This remediation ensures that the driver maintains proper state management during connection loss events and prevents the memory management race conditions that led to the original crash scenario.