CVE-2024-50135

Summary

CVE-2024-50135 is a vulnerability in the Linux kernel's NVMe PCI driver. The issue involves a race condition between the functions nvme_dev_disable() and nvme_pci_update_nr_queues(). The former modifies the dev->online_queues field, which can lead to invalid values being passed to blk_mq_update_nr_hw_queues() if the latter function races against it. This flaw can cause system instability or crashes, and it has been reported to occur in the nvme-reset-wq workqueue. The vulnerability can be addressed by locking the shutdown_lock mutex before accessing dev->online_queues.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.