Security readout for executives and security teams
Plain-English summary
A failure in Linux's qla2xxx storage driver can leave an NVMe Fibre Channel port invalid, after which background work may dereference a null pointer and crash the kernel. The documented impact is loss of availability, not data disclosure or modification. Exposure appears concentrated on systems using this driver and NVMe/FC path.
Executive priority
Treat as a high-priority availability issue for storage infrastructure using qla2xxx and NVMe/FC. Schedule supported kernel updates promptly, especially where a host crash would interrupt critical workloads. Broader emergency action is not supported because the supplied evidence neither shows active exploitation nor establishes exposure on systems outside this configuration.
Technical view
qla_nvme_register_remote() could continue after qla_nvme_register_hba() failed and incorrectly validate nvme_local_port. It then passed a null local-port value into nvme_fc_register_remoteport(), causing a kernel NULL-pointer dereference. The stable fixes return after failed HBA registration and correctly validate the local port.
Likely exposure
Likely limited to Linux hosts where the qla2xxx Fibre Channel driver and NVMe/FC registration path are used. Systems without the relevant driver or storage configuration are less likely exposed. Exact distribution package status is not established by the bundle; installed kernels must be mapped to vendor advisories and the listed stable commits.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Although its CVSS vector uses a network attack vector, the supplied crash evidence concerns driver and remote-port registration. That score alone does not establish direct Internet exploitability.
Researcher notes
The failure trace places the dereference in nvme_fc_register_remoteport() from qla_nvme_register_remote(), executed by qla_register_fcport_fn. The decisive exposure condition is the relevant driver path combined with failed HBA/local-port registration. The bundle contains branch-specific fixes but no proof-of-concept, exploitation telemetry, or precise distribution package mapping.
Mitigation direction
- Install a distribution-supported kernel update incorporating the applicable Linux stable fix, then reboot into the updated kernel.
- Confirm the vendor maps its patched kernel package to an applicable listed stable commit.
- If patching is delayed, consult the Linux distributor for supported mitigations; none are specified in the supplied sources.
- Prioritize storage hosts where qla2xxx provides NVMe over Fibre Channel connectivity.
Validation and detection
- Inventory running kernel versions and identify hosts loading qla2xxx or using NVMe over Fibre Channel.
- Compare each distribution kernel package with vendor advisories and the listed branch-specific stable commits.
- After updating and rebooting, confirm the running kernel is the remediated package.
- Review kernel logs for register_localport failures, qla2xxx crashes, and NULL dereferences during remote-port registration.
Public sources used
- CVE Program record
- CVE List V5 record
- Linux stable fix 549aac965532
- Linux stable fix e1f010844443
- Linux stable fix a3ab508a4853
- Linux stable fix cde43031df53
- Linux stable fix 7cec2c3bfe84
- Linux stable fix f6be298cc104
- Linux stable fix 3eac973eb5cb
- Linux stable fix eb1d4ce26095
- Debian LTS announcement, January 2025
- Debian LTS announcement, October 2024
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42286 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/549aac9655320c9b245a24271b204668c5d40430CVE reference, Linux
- https://git.kernel.org/stable/c/e1f010844443c389bc552884ac5cfa47de34d54cCVE reference, Linux
- https://git.kernel.org/stable/c/a3ab508a4853a9f5ae25a7816a4889f09938f63cCVE reference, Linux
- https://git.kernel.org/stable/c/cde43031df533751b4ead37d173922feee2f550fCVE reference, Linux
- https://git.kernel.org/stable/c/7cec2c3bfe84539c415f5e16f989228eba1d2f1eCVE reference, Linux
- https://git.kernel.org/stable/c/f6be298cc1042f24d521197af29c7c4eb95af4d5CVE reference, Linux
- https://git.kernel.org/stable/c/3eac973eb5cb2b874b3918f924798afc5affd46bCVE reference, Linux
- https://git.kernel.org/stable/c/eb1d4ce2609584eeb7694866f34d4b213caa3af9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.