Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash systems using the qla2xxx Fibre Channel driver during virtual port deletion. The business concern is storage host instability during unload or maintenance workflows, not confirmed data theft or active exploitation.
Executive priority
Treat as maintenance-priority for general Linux fleets and higher priority for storage infrastructure using qla2xxx Fibre Channel vports. The main risk is host crash or storage disruption during lifecycle operations, with no provided evidence of exploitation in the wild.
Technical view
The qla2xxx driver could leave stale I/O entries in the outstanding command array while deleting a vport. Abort handling did not complete those I/Os before deletion, leading to a NULL pointer dereference in DMA unmap handling. The fix explicitly sends asynchronous logout for ports during vport delete.
Likely exposure
Exposure appears limited to Linux systems using the qla2xxx SCSI/Fibre Channel driver and virtual port deletion or unload workflows. The bundle lists affected Linux kernel ranges including 4.18 through fixed stable updates such as 4.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.103, 6.6.44, and 6.10.3.
Exploitation context
No active exploitation is supported by the provided sources, and KEV is false. The sources describe a reliability crash condition observed during vport delete, not a public exploit path. Preconditions, attacker control, and remote reachability are not established in the bundle.
Researcher notes
The evidence is strongest for root-cause and patch direction, but weak for exploitability. The bug is in qla2xxx vport delete cleanup: stale outstanding I/O entries reach DMA free paths after abort handling. Avoid assuming privilege boundaries or remote attack surface without additional vendor analysis.
Mitigation direction
- Update affected Linux kernels through vendor-supported packages containing the qla2xxx stable fixes.
- Prioritize hosts using QLogic qla2xxx Fibre Channel adapters or virtual ports.
- Review Debian LTS advisories if running Debian-packaged kernels.
- Schedule reboot or maintenance windows required by kernel updates.
- If no package is available, follow vendor guidance for backports or workarounds.
Validation and detection
- Inventory Linux kernel versions against the affected and fixed versions in the CVE record.
- Check whether the qla2xxx driver is loaded or used on storage hosts.
- Identify systems using Fibre Channel virtual ports or vport deletion workflows.
- Review kernel logs for NULL pointer dereference traces involving qla2xxx and dma_direct_unmap_sg.
- Confirm installed vendor kernel changelogs include the referenced qla2xxx fix.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 086489256696
- Linux stable commit 171ac4b495f9
- Linux stable commit e5ed6a26ffde
- Linux stable commit b12c54e51ba8
- Linux stable commit d28a2075bb53
- Linux stable commit 87c25fcb95aa
- Linux stable commit b35d6d5a2f38
- Linux stable commit 76f480d7c717
- Debian LTS advisory January 2025
- Debian LTS advisory October 2024
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42289 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/086489256696eb774654a5410e86381c346356feCVE reference, Linux
- https://git.kernel.org/stable/c/171ac4b495f9473bc134356a00095b47e6409e52CVE reference, Linux
- https://git.kernel.org/stable/c/e5ed6a26ffdec0c91cf0b6138afbd675c00ad5fcCVE reference, Linux
- https://git.kernel.org/stable/c/b12c54e51ba83c1fbc619d35083d7872e42ecdefCVE reference, Linux
- https://git.kernel.org/stable/c/d28a2075bb530489715a3b011e1dd8765ba20313CVE reference, Linux
- https://git.kernel.org/stable/c/87c25fcb95aafabb6a4914239f4ab41b07a4f9b7CVE reference, Linux
- https://git.kernel.org/stable/c/b35d6d5a2f38605cddea7d5c64cded894fbe8edeCVE reference, Linux
- https://git.kernel.org/stable/c/76f480d7c717368f29a3870f7d64471ce0ff8fb2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.