Security readout for executives and security teams
Plain-English summary
A flaw in the Linux NVMe over Fibre Channel target can deadlock while deleting a storage association. The affected shutdown work may stop progressing, causing loss of availability rather than data disclosure or modification. Business impact is concentrated in systems providing NVMe target storage over Fibre Channel.
Executive priority
Prioritize promptly where Linux hosts deliver business-critical NVMe storage over Fibre Channel. The primary risk is service interruption, not confidentiality or integrity loss. Other Linux systems can be triaged after confirming whether the affected target functionality is used.
Technical view
The nvmet-fc association-deletion path can flush nvmet_wq from nested work running on that queue, producing a deadlock. The kernel fix defers the relevant put operation to a separate work item. CVSS 3.1 scores it 7.5: network-reachable, low complexity, no privileges or user interaction, with high availability impact only.
Likely exposure
Exposure requires an affected Linux kernel and use of the nvmet-fc target functionality. General Linux systems not providing this NVMe over Fibre Channel role are less likely to be exposed. The supplied affected-version data is ambiguously formatted, so distributions' package advisories should determine exact exposure.
Exploitation context
The source bundle does not identify CISA KEV listing or provide evidence of active exploitation. Its CVSS vector describes a network-reachable denial-of-service condition requiring no privileges or user interaction, but the available sources do not establish practical attack prerequisites or observed abuse.
Researcher notes
No CWE is supplied. The affected-version array includes unusual and duplicated entries, preventing a reliable upstream range interpretation from this bundle alone. The cited stable commits are the strongest remediation references. No conclusion about exploit availability, reproducibility, or attack frequency should be drawn from the CVSS vector alone.
Mitigation direction
- Identify Linux hosts providing NVMe target storage over Fibre Channel.
- Consult the Linux distribution or appliance vendor for the corrected kernel package.
- Upgrade to a vendor-supported kernel containing the applicable cited stable fix.
- Prioritize storage targets whose interruption would affect critical services.
Validation and detection
- Record kernel versions and distribution package revisions on nvmet-fc target hosts.
- Confirm whether nvmet-fc target functionality is configured and operational.
- Map each package to its vendor advisory because supplied version boundaries are unclear.
- Verify the installed kernel incorporates the applicable cited stable commit.
- Monitor affected storage targets for association-deletion hangs or stalled shutdown work.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26769 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H0.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5e0bc09a52b6169ce90f7ac6e195791adb16cec4CVE reference, Linux
- https://git.kernel.org/stable/c/9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8CVE reference, Linux
- https://git.kernel.org/stable/c/eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30CVE reference, Linux
- https://git.kernel.org/stable/c/1d86f79287206deec36d63b89c741cf542b6caddCVE reference, Linux
- https://git.kernel.org/stable/c/710c69dbaccdac312e32931abcb8499c1525d397CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.