{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53093", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.982Z", "datePublished": "2024-11-21T18:17:09.807Z", "dateUpdated": "2026-08-05T11:43:36.925Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:36.925Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller's scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - NVMe multipath heads exist for all NVMe-over-Fabrics subsystems, and a remote NVMe/TCP target reaches this code over a routable TCP connection by sending a Namespace-Changed AEN and then inducing a path error. The entire trigger sequence is delivered as protocol data from a remote peer.\nAC:L - The attacker controls both halves of the condition — it decides when scan_work runs (NS_CHANGED AEN) and when the path fails (connection drop, error completion, or ANA inaccessible state), so the deadlock window is created rather than waited for. No memory layout or victim state outside attacker influence is needed.\nPR:N - NVMe/TCP has no mandatory authentication or transport security, so a malicious, compromised, or spoofed target needs no credentials on the victim host. The AEN and error-injection path requires no login to the host system at all.\nUI:N - The host connection is a pre-existing configuration state, not an action taken per-attack; the target drives the AEN and path failure asynchronously with no local user involvement.\nS:U - The deadlock is confined to the kernel's own storage stack within the same security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The flaw is a blocking-context deadlock with no out-of-bounds access, freed-object reuse, or uninitialized data exposure, so no information is disclosed.\nI:N - No memory is corrupted and no data is modified; the partition-scan I/O is requeued intact rather than being mis-executed or written incorrectly.\nA:H - scan_work deadlocks permanently while holding ctrl->scan_lock, and every recovery path (nvme_stop_ctrl reset, nvme_remove_namespaces delete/disconnect) does flush_work(&ctrl->scan_work) and hangs too, producing unkillable D-state tasks, hung-task panics, and a permanently inaccessible storage subsystem requiring a reboot." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/multipath.c", "drivers/nvme/host/nvme.h" ], "versions": [ { "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f", "lessThan": "60de2e03f984cfbcdc12fa552f95087c35a05a98", "status": "affected", "versionType": "git" }, { "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f", "lessThan": "4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e", "status": "affected", "versionType": "git" }, { "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f", "lessThan": "a91b7eddf45afeeb9c5ece11dddff5de0921b00f", "status": "affected", "versionType": "git" }, { "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f", "lessThan": "1f021341eef41e77a633186e9be5223de2ce5d48", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/host/multipath.c", "drivers/nvme/host/nvme.h" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.118", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.62", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.9", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.118" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.62" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.11.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/60de2e03f984cfbcdc12fa552f95087c35a05a98" }, { "url": "https://git.kernel.org/stable/c/4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e" }, { "url": "https://git.kernel.org/stable/c/a91b7eddf45afeeb9c5ece11dddff5de0921b00f" }, { "url": "https://git.kernel.org/stable/c/1f021341eef41e77a633186e9be5223de2ce5d48" } ], "title": "nvme-multipath: defer partition scanning", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53093", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:11:24.276538Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:13.381Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:29:08.209Z" } } ] } }