CVE-2024-53093

What it actually does

A race condition in nvme-multipath allows partition scanning to occur inside the controller's scan_work context; a path error then blocks on path availability while the required recovery action also runs in the same context, producing a deadlock.

Why it matters to the business

Affected Linux systems using NVMe multipath storage may experience controller scan hangs or complete storage path loss; the low EPSS and absence from KEV indicate limited active exploitation risk despite the 690 days since publication and stable 0.0061 EPSS trend.

How an attack unfolds

An attacker triggers a path error during controller scan_work; the resulting partition scan blocks indefinitely because recovery actions cannot proceed in the same context, causing denial of service. Listed threat actors such as Advanced Spyware Campaign and 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors have been observed exploiting similar kernel race conditions in other campaigns.

How to fix it

Update affected Samba packages on Ubuntu 14.04 LTS to 2:4.3.11+dfsg-0ubuntu0.14.04.4 and on Ubuntu 16.04 LTS to 2:4.3.11+dfsg-0ubuntu0.16.04.3; rebuild and reboot systems using the updated kernel modules.

How to confirm the fix worked

Confirm package versions match the listed fixed releases, verify absence of deadlock traces in dmesg during simulated path failures, and ensure scan_work no longer performs partition scans.

Typical attack path

1. Establish NVMe multipath configuration on target
2. Induce a transient path error during active scan_work
3. Force partition scan inside the blocked context
4. Trigger deadlock that prevents path recovery

How to detect it

Search kernel logs and dmesg for repeated nvme scan_work entries that coincide with path errors or multipath recovery timeouts; correlate with threat actor TTPs from Advanced Spyware Campaign and 2024 Zero-Day Exploitation Campaigns.

What your security team should do

• Apply the listed fixed package versions within standard change windows given low EPSS
• Monitor kernel logs for nvme scan_work stalls
• Test multipath failover behavior after upgrade
• Review downstream dependents for similar race-condition exposure