scsi: qla2xxx: Fix command flush on cable pull

{
  "id": "23c12d3d7a7b578f40428cdf8557a153956f9946addde904fb5cd0dbb78caf0d",
  "url": "https://osv.dev/vulnerability/CVE-2024-26931",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "scsi: qla2xxx: Fix command flush on cable pull",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace",
    "evidence": "osv:CVE-2024-26931",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.19.312",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.274",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.215",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.154",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.84",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.24",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.7.12",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.8.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-26931",
      "aliases": [
        "CVE-2024-26931"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "726b85487067d7f5b23495bc33c484b8517c4074"
                },
                {
                  "fixed": "b73377124f56d2fec154737c2f8d2e839c237d5a"
                },
                {
                  "fixed": "d7a68eee87b05d4e29419e6f151aef99314970a9"
                },
                {
                  "fixed": "67b2d35853c2da25a8ca1c4190a5e96d3083c2ac"
                },
                {
                  "fixed": "a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a"
                },
                {
                  "fixed": "09c0ac18cac206ed1218b1fe6c1a0918e5ea9211"
                },
                {
                  "fixed": "8de1584ec4fe0ebea33c273036e7e0a05e65c81d"
                },
                {
                  "fixed": "8f0d32004e3a572bb77e6c11c2797c87f8c9703d"
                },
                {
                  "fixed": "ec7587eef003cab15a13446d67c3adb88146a150"
                },
                {
                  "fixed": "a27d4d0e7de305def8a5098a614053be208d1aa1"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26931.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.11.0"
                },
                {
                  "fixed": "4.19.312"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.274"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.215"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.154"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.84"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.24"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.7.12"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.8.0"
                },
                {
                  "fixed": "6.8.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26931.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.289913417Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211",
        "https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac",
        "https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d",
        "https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d",
        "https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1",
        "https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a",
        "https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a",
        "https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9",
        "https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26931.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-26931",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26931.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-26931",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499358,
  "published_at": "2024-05-01T05:17:14.823+00:00"
}