CVE-2024-42289 scsi: qla2xxx: During vport delete send async logout explicitly

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New CVEs Affecting qla2xxx SCSI Driver Published Two new CVEs, CVE-2024-42287 and CVE-2024-42289, were published on August 17, 2024, affecting the qla2xxx SCSI driver. CVE-2024-42287 addresses an issue with command completion within a lock, while CVE-2024-42289 involves sending an asynchronous logout during virtual port deletion. These vulnerabilities may impact systems utilizing the qla2xxx driver. 3 sources 39