CVE-2024-36952

What it actually does

Race condition in the lpfc driver where fc_remove_host and scsi_remove_host are invoked before Remove All DA_ID CT and LOGO ELS commands are sent, allowing the final ndlp reference to be dropped and the rport freed prematurely, leaving the fabric switch with a stale NPIV login entry.

Why it matters to the business

May cause storage fabric state inconsistencies after virtual port deletion on affected Linux systems, potentially leading to connectivity issues or manual recovery steps in SAN environments; low operational urgency given absence from known exploited lists and stable low exploit probability.

How an attack unfolds

An attacker with local privileges sufficient to trigger NPIV vport deletion can race the unregistration path so that fabric logout commands are skipped, resulting in the switch retaining an active session reference that the host has already released.

How to fix it

Upgrade the Linux kernel to a version containing commit f2c7f029051edc4b394bb48edbe2297575abefe0; rebuild and reboot with the corrected lpfc module that ensures DA_ID and LOGO are sent prior to fc_remove_host and scsi_remove_host.

How to confirm the fix worked

Confirm the running kernel contains commit f2c7f029051edc4b394bb48edbe2297575abefe0 via git log or kernel version string; test NPIV vport deletion and verify that Remove All DA_ID and LOGO frames are emitted before host removal completes.

Typical attack path

1. Obtain local access or privileges on a system using the lpfc driver with NPIV enabled
2. Trigger deletion of an NPIV vport through administrative interfaces or scripts
3. Exploit the window between resource cleanup and transport unregistration to skip DA_ID and LOGO transmission
4. Observe resulting stale login state on the fabric switch

How to detect it

Inspect system logs for lpfc driver messages around vport deletion events, particularly sequences where dev_loss_tmo occurs before expected fabric logout frames; correlate with switch logs showing persistent NPIV logins after host-side removal.

What your security team should do

• Prioritize kernel updates on systems exposing lpfc NPIV functionality
• Review change management processes for storage drivers in production SAN hosts
• Include lpfc-related kernel fixes in the next scheduled maintenance window