Kernel Hang Issue in Linux Package Due to NVMe-RDMA Admin Queue Management
Summary
CVE-2024-49569: In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including process management, memory management, and device control. The NVMe (Non-Volatile Memory Express) subsystem in the Linux kernel facilitates high-speed data transfer between the CPU and storage devices. However, a recent vulnerability has been identified in the NVMe-RDMA (Remote Direct Memory Access) implementation, which can lead to system hangs during the destruction of the admin queue.
Vulnerability Detail
The vulnerability, identified as CVE-2024-49569, arises from improper management of the admin queue in the NVMe-RDMA subsystem. Specifically, the kernel fails to unquiesce the admin queue before destroying it, leading to a situation where pending requests are not drained. This oversight causes the kernel to hang indefinitely during the queue destruction process, as it waits for requests that will never complete. The issue is particularly critical as it can affect system stability and performance, potentially leading to data loss or corruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2024-49569 is a critical vulnerability in the Linux kernel's NVMe-RDMA subsystem that can lead to system hangs. Users are encouraged to update their systems to the patched version as soon as it becomes available to ensure stability and prevent potential data loss. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49569 is a vulnerability in the Linux kernel's NVMe-RDMA subsystem that can cause the kernel to hang during the destruction of the admin queue.
The vulnerability affects the Linux kernel versions used in Debian 11, 12, and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to system hangs, affecting stability and performance, and may result in data loss or corruption.
Yes, a patch is available for Debian 13 in version 6.12.5-1. Users of Debian 11 and 12 should monitor for updates.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
