What’s Vulnerable › Vulnerabilities

CVE-2024-43821: scsi: lpfc: Fix a possible null pointer dereference

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-17 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix a possible null pointer dereference In function lpfc_xcvr_data_show, the memory allocation with kmalloc might fail, thereby making rdp_context a null pointer. In the following context and functions that use this pointer, there are dereferencing operations, leading to null pointer dereference. To fix this issue, a null pointer check should be added. If it is null, use scnprintf to notify the user and return len.

Affected products

• Linux kernel: from 6.2 before 6.6.44; from 6.7 before 6.10.3 — fixed in 6.10.3, 6.6.44

How to fix

Upgrade to a fixed version: Linux kernel 6.10.3, 6.6.44. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/45b2a23e00d448a9e6d1f371ca3a4d4b073fe78c
• https://git.kernel.org/stable/c/57600a7dd2b52c904f7c8d2cac0fd8c23868e680
• https://git.kernel.org/stable/c/5e0bf3e8aec2cbc51123f84b29aaacbd91fc56fa

Get alerted when CVE-2024-43821 or the next vulnerability affects your stack