CVE-2024-42289

mediumpriority · track · 22EPSS 0.002 · 15 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 5.5 · medium

Is it mine?

75 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-24

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but I/Os could not complete while vport delete is in process of deleting. BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Workqueue: qla2xxx_wq qla_do_work [qla2xxx] RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0 RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8 R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0 Call Trace: <TASK> qla2xxx_qpair_sp_free_dma+0x417/0x4e0 ? qla2xxx_qpair_sp_compl+0x10d/0x1a0 ? qla2x00_status_entry+0x768/0x2830 ? newidle_balance+0x2f0/0x430 ? dequeue_entity+0x100/0x3c0 ? qla24xx_process_response_queue+0x6a1/0x19e0 ? __schedule+0x2d5/0x1140 ? qla_do_work+0x47/0x60 ? process_one_work+0x267/0x440 ? process_one_work+0x440/0x440 ? worker_thread+0x2d/0x3d0 ? process_one_work+0x440/0x440 ? kthread+0x156/0x180 ? set_kthread_struct+0x50/0x50 ? ret_from_fork+0x22/0x30 </TASK> Send out async logout explicitly for all the ports during vport delete.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-476USprimaryCWE-476US

affected products (75)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Broadcom Brocade SANnavall versionscert_bundDEcpe:/a:broadcom:brocade_sannav:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell NetWorker vProxy <19.14all versionscert_bundDE
Google Container-Optimized OSall versionscert_bundDEcpe:/o:google:container-optimized_os:-
IBM DataPower Gateway <10.6.5.0all versionscert_bundDE
IBM InfoSphere Guardiumall versionscert_bundDEcpe:/a:ibm:infosphere_guardium:-
IBM QRadar SIEM <7.5.0 UP10 IF01all versionscert_bundDE
IBM QRadar SIEM <7.5.0 UP11all versionscert_bundDE
IBM Security Guardium 12.0all versionscert_bundDEcpe:/a:ibm:security_guardium:12.0
IBM Spectrum Protect Plus <10.1.6.4all versionscert_bundDE
Open Source Linux Kernel <6.11-rc4all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SolarWinds Security Event Manager <2025.2.1all versionscert_bundDE
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Networker≤ vProxy <19.14cert_bundDE
IBM DataPower Gateway< 10.6.5.0cert_bundDE

showing 20 of 75

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1875Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-08-18csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder unbekannte Auswirkungen zu erzielen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-08-17modified 2026-06-17

related (8,754)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-21525US	—OT critical	4.83% (92nd)	KEV	2026-02-10
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
CVE-2010-0425US	high10.0	94.2% (100th)	Exploit	2010-03-05
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure…
CVE-2012-0779US	high9.3	87.1% (100th)	Exploit	2012-05-04
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x a…
CVE-2012-5896US	high10.0	68.7% (99th)	Exploit	2012-11-17
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers…
CVE-2003-0772US	high7.5	84.9% (100th)	Exploit	2003-09-22
Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long (1) APPE (append) or (2) STAT…

+8749 more

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan