PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-24855 Linux CVE debrief

CVE-2024-24855 is a Linux kernel vulnerability published on 2024-02-05 and later modified on 2026-05-12 in NVD. The issue is a race condition in lpfc_unregister_fcf_rescan() that can lead to a null pointer dereference, with possible impact ranging from a kernel crash to denial of service. NVD classifies the issue as medium severity, and the supplied vector indicates local access, low privileges, and user interaction are required.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Linux distribution security teams, kernel maintainers, and operators of systems that run affected Linux kernel branches should care, especially where the lpfc code path is present and system availability is important.

Technical summary

The supplied NVD record describes a race condition in the Linux kernel scsi device driver function lpfc_unregister_fcf_rescan(). NVD maps the weakness to CWE-362 and CWE-476 and lists affected kernel ranges including versions up to 2.6.33.20 and 6.0 through 6.4.16, plus the 2.6.34-rc1 and 6.5-rc1 lines. The CVSS vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H, which suggests exploitation is constrained but can still affect availability.

Defensive priority

Medium

Recommended defensive actions

  • Identify whether your Linux systems run kernel versions in the affected ranges listed by NVD.
  • Check whether the lpfc driver path is present in your environment and prioritize systems where kernel availability is critical.
  • Apply vendor or distribution kernel updates referenced by official advisories as they become available.
  • Monitor for unexpected kernel crashes, panics, or denial-of-service symptoms on systems matching the affected criteria.
  • Use least privilege and restrict unnecessary local access, since the supplied CVSS vector requires local access and user interaction.

Evidence notes

All claims are based on the supplied NVD record and its official or referenced links: CVE record, NVD detail page, and downstream references from OpenAnolis Bugzilla, Debian LTS announce, and Siemens CERT. The record identifies the issue as a race condition in lpfc_unregister_fcf_rescan(), maps it to CWE-362 and CWE-476, and lists affected Linux kernel version ranges. No exploit code, weaponized reproduction, or unverified fix version is included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-24855 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-24855

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-24855 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-24855

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

    af854a3a-2127-422b-91ae-364da2661108

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.