Linux SCSI libfc NULL Dereference Enables Local Denial of Service
Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 7, 2024
CVE-2023-52809 affects the Linux kernel SCSI libfc component: fc_lport_ptp_setup() failed to verify whether fc_rport_create() returned NULL. A local attacker able to reach the affected Fibre Channel code path could trigger a NULL-pointer dereference, crashing the host and causing denial of service. Red Hat rates the flaw Low severity with a CVSS v3.1 score of 4.4, while NVD assigns 5.5; both identify high availability impact.
Linux stable kernels have been fixed across supported branches, and the kernel CVE team advises updating to the latest stable release rather than cherry-picking the patch. Red Hat issued fixes for RHEL 8 and multiple RHEL 9 streams, including RHEL 9 and 9.2 EUS; kernel-rt packages for RHEL 8 and RHEL 9 remained affected at publication. RHEL 6 and RHEL 7 kernel packages are outside support scope and should be treated as affected.
