---
id: CVE-2024-46842
title: 'scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info

  The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the
  routine unconditionally frees submitte…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 <
    c6d8cce685d6088d795b29a0f47e6fd04548fd64
  - >-
    Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 <
    bba47fe3b038cca3d3ebd799665ce69d6d273b58
  - >-
    Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 <
    ede596b1434b57c0b3fd5c02b326efe5c54f6e48
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-29T13:59:24.823160Z'
published: '2024-09-27'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:15.471Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-46842'
references:
  - url: 'https://git.kernel.org/stable/c/c6d8cce685d6088d795b29a0f47e6fd04548fd64'
  - url: 'https://git.kernel.org/stable/c/bba47fe3b038cca3d3ebd799665ce69d6d273b58'
  - url: 'https://git.kernel.org/stable/c/ede596b1434b57c0b3fd5c02b326efe5c54f6e48'
tags:
  - cve.org
epss: 0.00293
epssPercentile: 0.22075
ingestedAt: '2026-10-21T12:48:53.729Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info

The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the
routine unconditionally frees submitted mailbox commands regardless of
return status.  The issue is that for MBX_TIMEOUT cases, when firmware
returns SFP information at a later time, that same mailbox memory region
references previously freed memory in its cmpl routine.

Fix by adding checks for the MBX_TIMEOUT return code.  During mailbox
resource cleanup, check the mbox flag to make sure that the wait did not
timeout.  If the MBOX_WAKE flag is not set, then do not free the resources
because it will be freed when firmware completes the mailbox at a later
time in its cmpl routine.

Also, increase the timeout from 30 to 60 seconds to accommodate boot
scripts requiring longer timeouts.

## Affected

- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < c6d8cce685d6088d795b29a0f47e6fd04548fd64`
- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < bba47fe3b038cca3d3ebd799665ce69d6d273b58`
- `Linux >= 479b0917e4477f49df2e3be454aac3cfa5dec171 < ede596b1434b57c0b3fd5c02b326efe5c54f6e48`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.