What is the CVSS score of CVE-2024-26769?

CVE-2024-26769 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-26769?

The Linux kernel NVMe over Fibre Channel (nvmet-fc) target subsystem contains a flaw that causes system hangs and denial of service, directly threatening availability of NVMe-oF FC-based storage…. A patch is available.

How to fix or mitigate CVE-2024-26769?

Within 24 hours, identify all systems running the Linux kernel with nvmet-fc module active, particularly production NVMe-oF FC target systems, and audit current kernel versions across the infrastructure. Within 7 days, prioritize patching for production storage systems and develop a kernel update plan with scheduled downtime windows if required. Within 30 days, deploy the available vendor patch across all affected Linux systems, verifying post-deployment that nvmet-fc module functionality remains stable and no regression occurs in NVMe-oF FC association handling.

Linux Kernel CVE-2024-26769

HIGH

2024-04-03 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Fibre Channel is an adjacent storage fabric, not internet-routable; AV:A more accurately reflects reachability than AV:N, while A:H captures the kernel deadlock impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:38 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:37 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:37 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

4.4 (MEDIUM) 7.5 (HIGH)

CVE Published

Apr 03, 2024 - 17:15 cve.org

MEDIUM 4.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvmet-fc: avoid deadlock on delete association path

When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferring the put work into its own work item.

AnalysisAI

Deadlock in the Linux kernel nvmet-fc (NVMe over Fibre Channel target) subsystem can cause a system hang during association teardown, resulting in a denial of service. Kernels with the nvmet-fc module active are affected when an NVMe-oF FC association deletion is processed, causing the shutdown path to attempt a nested flush of nvmet_wq against itself. No public exploit has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low real-world exploitation probability despite the CVSS 7.5 rating.

Technical ContextAI

The affected subsystem is nvmet-fc, the Linux kernel's NVMe over Fibre Channel target driver, which enables a host to serve NVMe storage namespaces to remote initiators over a Fibre Channel fabric. The root cause is a classic nested workqueue deadlock: during the delete-association shutdown sequence, the code calls flush_workqueue() on nvmet_wq from within a work item already executing on nvmet_wq, causing the kernel to block waiting for itself. The fix defers the association put operation into an independent work item so that the flush no longer nests. CPE data confirms affected products span multiple Linux kernel stable branches including 6.8-rc1 and 6.8-rc2. No formal CWE is assigned, but the class is CWE-833 (Deadlock) or CWE-667 (Improper Locking). The 'Information Disclosure' tag in the intelligence feed appears to be a tagging error - the vulnerability has no confidentiality impact per CVSS or description.

RemediationAI

Apply the upstream kernel patches committed to the stable tree, available at the following kernel.org stable commits: 1d86f79287206deec36d63b89c741cf542b6cadd, 5e0bc09a52b6169ce90f7ac6e195791adb16cadd, 710c69dbaccdac312e32931abcb8499c1525d397, 9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8, and eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30. Organizations using distribution kernels should apply the next stable update from their vendor once patches are backported. As a compensating control where patching is not immediately possible, disabling or unloading the nvmet-fc kernel module (if NVMe-oF FC target functionality is not required) eliminates the vulnerable code path entirely with the trade-off of removing FC target capability. Restricting FC zone access on SAN switches to only known authorized initiator WWPNs limits the pool of hosts able to trigger the association deletion path, but does not eliminate the vulnerability if rogue initiators gain fabric access.