CVE-2024-42286 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2024-42286?

CVE-2024-42286 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's QLogic Fibre Channel driver (qla2xxx) can cause kernel crashes when NVMe over Fabrics registration fails. This affects systems using QLogic FC HBAs with NVMe functionality. The vulnerability requires local access to trigger.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's QLogic Fibre Channel driver (qla2xxx) can cause kernel crashes when NVMe over Fabrics registration fails. This affects systems using QLogic FC HBAs with NVMe functionality. The vulnerability requires local access to trigger.

💻 Affected Systems

Products:

Linux kernel with qla2xxx driver

Versions: Kernel versions before fixes in stable trees (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with QLogic FC HBAs and NVMe over Fabrics functionality enabled.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash during driver initialization or FC port registration, requiring reboot to restore functionality.

🟢

If Mitigated

Minimal impact with proper kernel hardening and crash recovery mechanisms in place.

🌐 Internet-Facing: LOW - Requires local access to trigger, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local attackers or misconfigured services could trigger crashes affecting system availability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Triggered by normal driver operations during failure conditions.

Exploitation requires ability to trigger driver failure conditions, typically through local access or misconfiguration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 3eac973eb5cb2b874b3918f924798afc5affd46b, 549aac9655320c9b245a24271b204668c5d40430, 7cec2c3bfe84539c415f5e16f989228eba1d2f1e, a3ab508a4853a9f5ae25a7816a4889f09938f63c, cde43031df533751b4ead37d173922feee2f550f

Vendor Advisory: https://git.kernel.org/stable/c/3eac973eb5cb2b874b3918f924798afc5affd46b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fixes. 2. Reboot system. 3. Verify driver loads without errors.

🔧 Temporary Workarounds

Disable NVMe over Fabrics

linux

Prevent qla2xxx driver from using NVMe functionality

modprobe -r qla2xxx
modprobe qla2xxx ql2xnvmeenable=0

Blacklist qla2xxx driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist qla2xxx' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict local access to systems with QLogic FC HBAs
Implement kernel crash recovery and monitoring for system stability

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if qla2xxx module is loaded: lsmod | grep qla2xxx && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and driver loads without 'register_localport failed' errors in dmesg

📡 Detection & Monitoring

Log Indicators:

kernel: BUG: unable to handle kernel NULL pointer dereference
qla2xxx: register_localport failed
kernel panic related to qla2xxx or nvme_fc

Network Indicators:

Unexpected FC port disconnections or registration failures

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "qla2xxx" OR "register_localport failed")

📊 Metadata

CVE ID: CVE-2024-42286

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: August 17, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42286, you might also want to check these: