Answer in brief
CVE-2024-50135 records a Medium severity (CVSS 4.7) vulnerability in nvme-pci: fix race condition between reset and nvme_dev_disable(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=949928c1c731417cc0f070912c63878b62b544f4 <0beb55fc6086c86eb07954c914e728a8cb0cd57e || >=949928c1c731417cc0f070912c63878b62b544f4 <4ed32cc0939b64e3d7b48c8c0d63ea038775f304 || >=949928c1c731417cc0f070912c63878b62b544f4 <b33e49a5f254474b33ce98fd45dd0ffdc247a0be || >=949928c1c731417cc0f070912c63878b62b544f4 <26bc0a81f64ce00fc4342c38eeb2eddaad084dd2 | 0beb55fc6086c86eb07954c914e728a8cb0cd57e, 4ed32cc0939b64e3d7b48c8c0d63ea038775f304, b33e49a5f254474b33ce98fd45dd0ffdc247a0be, 26bc0a81f64ce00fc4342c38eeb2eddaad084dd2 |
| Linux/Linuxgeneric | 4.6 | Not reported |
Published upstream
Nov 5, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modifies the dev->online_queues field, therefore nvme_pci_update_nr_queues() should avoid racing against it, otherwise we could end up passing invalid values to blk_mq_update_nr_hw_queues(). WARNING: CPU: 39 PID: 61303 at drivers/pci/msi/api.c:347 pci_irq_get_affinity+0x187/0x210 Workqueue: nvme-reset-wq nvme_reset_work [nvme] RIP: 0010:pci_irq_get_affinity+0x187/0x210 Call Trace: <TASK> ? blk_mq_pci_map_queues+0x87/0x3c0 ? pci_irq_get_affinity+0x187/0x210 blk_mq_pci_map_queues+0x87/0x3c0 nvme_pci_map_queues+0x189/0x460 [nvme] blk_mq_update_nr_hw_queues+0x2a/0x40 nvme_reset_work+0x1be/0x2a0 [nvme] Fix the bug by locking the shutdown_lock mutex before using dev->online_queues. Give up if nvme_dev_disable() is running or if it has been executed already.
Quoted source text, attributed separately from HOL analysis.