Loading story…
CVE-2024-36952 is a moderate-severity flaw in the Linux kernel's lpfc SCSI driver affecting its NPIV virtual-port cleanup path. A race condition can unregister a virtual port and free its remote-port object before the driver sends its final Remove All DA_ID CT and LOGO ELS requests, causing a Fibre Channel fabric switch to retain an incorrect logged-in NPIV session state.
Red Hat rated the issue CVSS v3.1 4.4 and released fixes for supported Red Hat Enterprise Linux 8 and 9 streams; RHEL 6 and 7 are outside support scope. The correction defers fc_remove_host() and scsi_remove_host() until after the DA_ID and LOGO messages are transmitted, addressing an incomplete-cleanup condition consistent with CWE-459.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released a fixed RHEL 8 kernel through RHSA-2024:5101.
Red Hat released a fixed RHEL 9 kernel through RHSA-2024:4928.
Red Hat issued fixed kernel and kernel-rt packages for RHEL 9.2 Extended Update Support via RHSA-2024:4823 and RHSA-2024:4831.
Red Hat released a fixed kernel for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions through RHSA-2024:4447.
Red Hat released a fixed kernel for RHEL 8.8 Extended Update Support through RHSA-2024:8107.
The Linux kernel CVE team assigned CVE-2024-36952 for a race in the SCSI lpfc driver's NPIV virtual-port deletion path that could skip final DA_ID and LOGO fabric requests. Fixes moved host unregistration after cleanup and fabric notifications, and were included in kernel versions 5.15.159, 6.1.91, 6.6.31, 6.8.10, and 6.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52809** affects the Linux kernel SCSI `libfc` component: `fc_lport_ptp_setup()` failed to verify whether `fc_rport_create()` returned `NULL`. A local attacker able to reach the affected Fibre Channel code path could trigger a NULL-pointer dereference, crashing the host and causing denial of service. Red Hat rates the flaw Low severity with a CVSS v3.1 score of 4.4, while NVD assigns 5.5; both identify high availability impact. Linux stable kernels have been fixed across supported branches, and the kernel CVE team advises updating to the latest stable release rather than cherry-picking the patch. Red Hat issued fixes for RHEL 8 and multiple RHEL 9 streams, including RHEL 9 and 9.2 EUS; `kernel-rt` packages for RHEL 8 and RHEL 9 remained affected at publication. RHEL 6 and RHEL 7 kernel packages are outside support scope and should be treated as affected.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 9, including the real-time kernel for RHEL 9.2 SAP Solutions and Extended Life Cycle environments, addressing **CVE-2025-38332**. The flaw affects BIOS-version handling in the Linux SCSI `lpfc` Fibre Channel driver: FORTIFY-enabled `strlcat()` can incorrectly flag a destination-buffer overflow and cause a kernel panic despite receiving the correct buffer size. The upstream remediation replaces the affected zero-initialization and `strlcat()` logic with `memcpy()` while retaining NUL termination required by `lpfc_printf_log()`. RHSA-2025:14005 provides `kernel-rt-5.14.0-284.131.1.rt14.416.el9_2` for affected x86_64 RHEL 9.2 SAP and ELC systems; RHSA-2025:15661 delivers fixes across supported RHEL 9 architectures and also addresses three additional kernel flaws. Organizations should install the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026
A flaw tracked as **CVE-2025-37861** affects the Linux kernel's `scsi: mpi3mr` driver, where improper synchronization between the reset thread and the task management thread can expose an invalid reply queue ID of `0xFFFF` during controller reset. That race can cause the task management path to reference unallocated memory and trigger a kernel crash, making the issue a denial-of-service risk. Red Hat rated the bug **Moderate** with a **CVSS 6.3**, while NVD and CVE.org scored it **7.8**; Red Hat said exploitation requires local access with a special group privilege and noted no integrity impact in the known use case. Upstream Linux fixed the bug by adding an `io_admin_reset_sync` flag to coordinate reset, I/O, and admin thread access to reply queues, block processing during reset, and mark the controller unrecoverable if synchronization does not complete within 10 seconds. The Linux kernel CVE team said the issue is resolved in versions **6.12.24**, **6.13.12**, **6.14.3**, and **6.15-rc1**, and advised users to move to the latest stable kernel release. Red Hat also shipped fixes across multiple **Red Hat Enterprise Linux 9** variants, including `kernel-rt` updates in advisory **RHSA-2026:3358**, while stating **RHEL 10** is affected and **RHEL 6** and **RHEL 7** kernel packages are not affected because the vulnerable code is absent.
Aug 25, 2026