CVE-2024-49569 (GCVE-0-2024-49569)
Vulnerability from cvelistv5 – Published: 2025-01-11 12:25 – Updated: 2026-08-05 11:40
VLAI
EPSS
VEX
Title
nvme-rdma: unquiesce admin_q before destroy it
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: unquiesce admin_q before destroy it
Kernel will hang on destroy admin_q while we create ctrl failed, such
as following calltrace:
PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme"
#0 [ff61d23de260fb78] __schedule at ffffffff8323bc15
#1 [ff61d23de260fc08] schedule at ffffffff8323c014
#2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1
#3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a
#4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006
#5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce
#6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced
#7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b
#8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362
#9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25
RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574
RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004
RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500
ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b
This due to we have quiesced admi_q before cancel requests, but forgot
to unquiesce before destroy it, as a result we fail to drain the
pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here
try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and
simplify the code.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
958dc1d32c80566f58d18f05ef1f05bd32d172c1 , < 427036030f4d796533dcadba9b845896cb6c10a7
(git)
Affected: 958dc1d32c80566f58d18f05ef1f05bd32d172c1 , < 05b436f3cf65c957eff86c5ea5ddfa2604b32c63 (git) Affected: 958dc1d32c80566f58d18f05ef1f05bd32d172c1 , < 5858b687559809f05393af745cbadf06dee61295 (git) Affected: a9ea34d2717a8c8892d3c5677329de9485e325ac (git) Affected: 7da81eaf8710130a9e63d7429627183be5a93787 (git) Affected: caed0b3851a4f52afd1ef77a27b30410fe7b68c7 (git) Affected: 5.4.103 , < 5.5 (semver) Affected: 5.10.21 , < 5.11 (semver) Affected: 5.11.4 , < 5.12 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.88 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "427036030f4d796533dcadba9b845896cb6c10a7",
"status": "affected",
"version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1",
"versionType": "git"
},
{
"lessThan": "05b436f3cf65c957eff86c5ea5ddfa2604b32c63",
"status": "affected",
"version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1",
"versionType": "git"
},
{
"lessThan": "5858b687559809f05393af745cbadf06dee61295",
"status": "affected",
"version": "958dc1d32c80566f58d18f05ef1f05bd32d172c1",
"versionType": "git"
},
{
"status": "affected",
"version": "a9ea34d2717a8c8892d3c5677329de9485e325ac",
"versionType": "git"
},
{
"status": "affected",
"version": "7da81eaf8710130a9e63d7429627183be5a93787",
"versionType": "git"
},
{
"status": "affected",
"version": "caed0b3851a4f52afd1ef77a27b30410fe7b68c7",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.103",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.21",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.88",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.5",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: unquiesce admin_q before destroy it\n\nKernel will hang on destroy admin_q while we create ctrl failed, such\nas following calltrace:\n\nPID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: \"nvme\"\n #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15\n #1 [ff61d23de260fc08] schedule at ffffffff8323c014\n #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1\n #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a\n #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006\n #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce\n #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced\n #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b\n #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362\n #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25\n RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202\n RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574\n RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004\n RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90\n R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004\n R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500\n ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b\n\nThis due to we have quiesced admi_q before cancel requests, but forgot\nto unquiesce before destroy it, as a result we fail to drain the\npending requests, and hang on blk_mq_freeze_queue_wait() forever. Here\ntry to reuse nvme_rdma_teardown_admin_queue() to fix this issue and\nsimplify the code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The error path that hangs is selected entirely by data the remote NVMe-oF target supplies over the fabric (ICDOFF and the keyed-SGL bit in Identify Controller, or refusal of I/O-queue connect), and RoCEv2/iWARP are routable IP transports, so a malicious or compromised target reachable over the network drives the bug. NVMe-oF host/target sessions are ordinary network protocol exchanges, matching the treatment of other nvme fabrics host-side flaws.\nAC:L - The target only has to advertise a non-zero icdoff or clear NVME_CTRL_SGLS_KSDBDS to deterministically force the host into the destroy_admin path, and any admin request left undispatched on the quiesced queue makes the freeze wait forever. The attacker can also re-drive controller creation repeatedly via discovery-log-change AENs, so no condition outside their control must happen to line up.\nPR:N - The attacker is the remote peer and needs no credentials on the victim host \u2014 NVMe-oF requires no mandatory authentication, and there is no capable() check anywhere on the nvmf_dev_write \u2192 nvme_rdma_setup_ctrl path. The host-side privileged action is performed by the system\u0027s own autoconnect tooling, not by the attacker.\nUI:N - On hosts configured for NVMe-oF, systemd/udev autoconnect creates controllers (new=true) automatically in response to discovery-log-change AENs from the target, so no human action is needed at exploitation time.\nS:U - The hang is confined to the kernel\u0027s own block/NVMe layer and the calling process; no security authority or isolation boundary is crossed.\nC:N - The defect is a missing unquiesce leading to an indefinite wait in blk_mq_freeze_queue_wait(); no freed or out-of-bounds memory is read and nothing is disclosed to the attacker.\nI:N - There is no memory corruption, no write primitive, and no unintended state modification \u2014 the queue simply never drains, so no data can be altered.\nA:H - The calling task blocks forever in TASK_UNINTERRUPTIBLE and is unkillable, holding nvmf_dev_mutex so every later /dev/nvme-fabrics operation on the system wedges too, pinning the module and preventing clean shutdown; the hung-task watchdog fires and panics the box when hung_task_panic is set."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:40:01.374Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/427036030f4d796533dcadba9b845896cb6c10a7"
},
{
"url": "https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63"
},
{
"url": "https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295"
}
],
"title": "nvme-rdma: unquiesce admin_q before destroy it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-49569",
"datePublished": "2025-01-11T12:25:19.455Z",
"dateReserved": "2025-01-09T09:50:31.772Z",
"dateUpdated": "2026-08-05T11:40:01.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-49569",
"date": "2026-09-15",
"epss": "0.00822",
"percentile": "0.55355"
},
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme-rdma: unquiesce admin_q before destroy it\\n\\nKernel will hang on destroy admin_q while we create ctrl failed, such\\nas following calltrace:\\n\\nPID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: \\\"nvme\\\"\\n #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15\\n #1 [ff61d23de260fc08] schedule at ffffffff8323c014\\n #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1\\n #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a\\n #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006\\n #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce\\n #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced\\n #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b\\n #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362\\n #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25\\n RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202\\n RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574\\n RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004\\n RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90\\n R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004\\n R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500\\n ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b\\n\\nThis due to we have quiesced admi_q before cancel requests, but forgot\\nto unquiesce before destroy it, as a result we fail to drain the\\npending requests, and hang on blk_mq_freeze_queue_wait() forever. Here\\ntry to reuse nvme_rdma_teardown_admin_queue() to fix this issue and\\nsimplify the code.\"}]",
"id": "CVE-2024-49569",
"lastModified": "2025-01-11T13:15:23.840",
"published": "2025-01-11T13:15:23.840",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-49569\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:23.840\",\"lastModified\":\"2026-08-04T11:20:49.400\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme-rdma: unquiesce admin_q before destroy it\\n\\nKernel will hang on destroy admin_q while we create ctrl failed, such\\nas following calltrace:\\n\\nPID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: \\\"nvme\\\"\\n #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15\\n #1 [ff61d23de260fc08] schedule at ffffffff8323c014\\n #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1\\n #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a\\n #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006\\n #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce\\n #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced\\n #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b\\n #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362\\n #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25\\n RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202\\n RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574\\n RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004\\n RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90\\n R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004\\n R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500\\n ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b\\n\\nThis due to we have quiesced admi_q before cancel requests, but forgot\\nto unquiesce before destroy it, as a result we fail to drain the\\npending requests, and hang on blk_mq_freeze_queue_wait() forever. Here\\ntry to reuse nvme_rdma_teardown_admin_queue() to fix this issue and\\nsimplify the code.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-rdma: anular la desactivaci\u00f3n de admin_q antes de destruirlo El kernel se bloquear\u00e1 al destruir admin_q mientras creamos un control fallido, como el siguiente calltrace: PID: 23644 TAREA: ff2d52b40f439fc0 CPU: 2 COMANDO: \\\"nvme\\\" #0 [ff61d23de260fb78] __schedule en ffffffff8323bc15 #1 [ff61d23de260fc08] schedule en ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait en ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue en ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue en ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue en ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl en ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl en ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write en ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write en ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 00000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b Esto se debe a que hemos silenciado admi_q antes de cancelar solicitudes, pero olvidamos reactivarlo antes de destruirlo, como resultado no podemos drenar las solicitudes pendientes y nos quedamos colgados en blk_mq_freeze_queue_wait() para siempre. Aqu\u00ed intente reutilizar nvme_rdma_teardown_admin_queue() para solucionar este problema y simplificar el c\u00f3digo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/host/rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"958dc1d32c80566f58d18f05ef1f05bd32d172c1\",\"lessThan\":\"427036030f4d796533dcadba9b845896cb6c10a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"958dc1d32c80566f58d18f05ef1f05bd32d172c1\",\"lessThan\":\"05b436f3cf65c957eff86c5ea5ddfa2604b32c63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"958dc1d32c80566f58d18f05ef1f05bd32d172c1\",\"lessThan\":\"5858b687559809f05393af745cbadf06dee61295\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a9ea34d2717a8c8892d3c5677329de9485e325ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7da81eaf8710130a9e63d7429627183be5a93787\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"caed0b3851a4f52afd1ef77a27b30410fe7b68c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.103\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.21\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.4\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/host/rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.88\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.103\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"77F47A48-724C-4A8A-BE16-F2C832EECA05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.21\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"FA8451E2-8B08-45A9-AEC4-3F6C9C651E35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.4\",\"versionEndExcluding\":\"6.6.88\",\"matchCriteriaId\":\"50680A57-28BE-4119-8130-0E39081E0A7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05b436f3cf65c957eff86c5ea5ddfa2604b32c63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/427036030f4d796533dcadba9b845896cb6c10a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5858b687559809f05393af745cbadf06dee61295\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T17:56:58+00:00",
"cve": "CVE-2024-49569",
"id": "CVE-2024-49569",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:fixed": "305",
"product_status:known_affected": "98",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nvme-rdma: unquiesce admin_q before destroy it",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49569.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-12T16:57:53Z",
"cve": "CVE-2024-49569",
"id": "CVE-2024-49569",
"initial_release_date": "2025-01-12T00:17:52Z",
"product_status:known_affected": "532",
"product_status:known_not_affected": "246",
"product_status:recommended": "401",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-49569",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49569.json",
"version": "127"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…