CVE-2024-24855
Advisory lineage Upstream: 0 Downstream: 22
Modified
Published: 05 Feb 2024, 07:25
Last modified:14 Jul 2026, 12:37
Vulnerability Summary
Overall Risk (default)
low
20/100 CVSS Score
5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.18% LOW
0% probability +0.17%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
05 Feb 2024, 07:25
Published
Vulnerability first disclosed
14 Jul 2026, 12:37
Last Modified
Vulnerability information updated
Description
A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
CVSS Metrics
- v3.1•MEDIUM•Score: 5CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
- v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.18%• Percentile: 8%
Techniques & Countermeasures
- CWE-476•NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
- CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected Systems
- linux•linux kernel
≤ 2.6.33.20 | ≥ 6.0, ≤ 6.4.16 | 2.6.34:rc1 | 6.5:rc1 | ≥ v2.6.34-rc2, < v6.5-rc2