{"id":"CVE-2024-46842","title":"scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitte…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < c6d8cce685d6088d795b29a0f47e6fd04548fd64","Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < bba47fe3b038cca3d3ebd799665ce69d6d273b58","Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < ede596b1434b57c0b3fd5c02b326efe5c54f6e48","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-29T13:59:24.823160Z"},"published":"2024-09-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:35:15.471Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-46842","references":[{"url":"https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64"},{"url":"https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58"},{"url":"https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48"}],"tags":["cve.org"],"epss":0.00293,"epssPercentile":0.2181,"ingestedAt":"2026-10-21T12:48:53.729Z","slug":"CVE-2024-46842","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts.\n\n## Affected\n\n- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < c6d8cce685d6088d795b29a0f47e6fd04548fd64`\n- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < bba47fe3b038cca3d3ebd799665ce69d6d273b58`\n- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < ede596b1434b57c0b3fd5c02b326efe5c54f6e48`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}