CVE-2024-42286

What it actually does

Failure to validate nvme_local_port before calling nvme_fc_register_remoteport results in a NULL pointer dereference (at offset 0x70) inside the qla2xxx driver workqueue, causing a kernel panic.

Why it matters to the business

Systems using QLogic Fibre Channel HBAs with NVMe over FC experience driver load failures and immediate kernel crashes, leading to downtime and potential data inaccessibility on affected Linux hosts; 33 downstream dependents amplify exposure across enterprise storage environments.

How an attack unfolds

An attacker with local access or the ability to trigger driver initialization (e.g., via hardware insertion or module load) can cause qla_nvme_register_hba to fail, after which the missing validation allows the subsequent NULL dereference in nvme_fc_register_remoteport during qla_register_fcport_fn execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 549aac9655320c9b245a24271b204668c5d40430 or later; ensure qla2xxx and nvme_fc modules are rebuilt against the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 549aac9655320c9b245a24271b204668c5d40430; attempt qla2xxx module load on NVMe-enabled FC hardware and verify absence of the register_localport error and NULL dereference crash.

Typical attack path

1. Trigger qla2xxx module load or FC port registration on a vulnerable kernel
2. Force qla_nvme_register_hba to return an error
3. Reach qla_nvme_register_remote without nvme_local_port validation
4. Execute nvme_fc_register_remoteport on a NULL pointer
5. Trigger kernel NULL dereference panic

How to detect it

Search kernel logs for the strings 'register_localport failed', 'qla_nvme_register_remote', 'nvme_fc_register_remoteport', and 'BUG: unable to handle kernel NULL pointer dereference' originating from qla2xxx workqueues.

• qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef
• BUG: unable to handle kernel NULL pointer dereference at 0000000000000070
• Workqueue: events_unbound qla_register_fcport_fn [qla2xxx]
• RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]
• qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]

What your security team should do

• Prioritize kernel upgrade on all systems exposing QLogic FC HBAs with NVMe
• Monitor for related kernel oops in production workloads
• Test patched kernels in staging before broad deployment due to storage stack sensitivity