CVE-2024-42289

What it actually does

NULL pointer dereference in dma_direct_unmap_sg during qla2xxx vport delete due to stale entries in the outstanding command array after eh_abort operations fail to complete I/Os, resulting in kernel oops and potential memory corruption.

Why it matters to the business

System crashes and downtime on Linux hosts using QLogic Fibre Channel adapters during virtual port deletion or driver unload; high ecosystem prevalence with over 29,000 downstream dependents increases operational risk across server fleets.

How an attack unfolds

An attacker with local access or the ability to trigger vport deletion (such as through driver unload or storage reconfiguration) can cause the kernel to dereference a NULL pointer in the qla2xxx workqueue path, leading to a crash; listed threat actors in broader Linux kernel campaigns may leverage similar memory issues but this specific flaw lacks confirmed remote exploitation.

How to fix it

Update the Linux kernel to a fixed version containing commit 086489256696eb774654a5410e86381c346356fe or later stable releases that explicitly send async logout during vport delete; apply vendor backports for supported distributions.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test vport creation/deletion and driver unload under load to verify no NULL dereference occurs; monitor dmesg for absence of the described oops signature.

Typical attack path

1. Gain local access or trigger vport delete operation on affected qla2xxx system
2. Initiate driver unload or vport removal while outstanding I/Os remain in the command array
3. eh_abort fast-fails I/Os but stale entries persist during deletion
4. qla_do_work processes response leading to dma_direct_unmap_sg on invalid pointer
5. Kernel NULL dereference causes oops and system instability

How to detect it

Search kernel logs for oops messages referencing dma_direct_unmap_sg, qla2xxx_qpair_sp_free_dma, or qla_do_work during vport-related workqueue activity; correlate with Fibre Channel adapter events around unload or delete operations.

What your security team should do

• Prioritize kernel updates on systems with qla2xxx adapters due to high downstream prevalence
• Schedule staged rollouts with vport delete testing in non-production environments
• Review storage multipath configurations to reduce reliance on vport operations during maintenance
• Monitor for future Linux kernel advisories in the scsi qla2xxx subsystem