CVE-2024-45013
A flaw in the Linux kernel’s NVMe driver can cause a kernel crash when a controller fails to start and the host driver is unloaded. The issue is fixed by moving the stop‑keep‑alive logic into the controller cleanup routine. Updating to a kernel version that includes this patch resolves the problem.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems running kernel 6.11 or earlier, especially those using NVMe storage devices.
Real-world impact
An attacker could trigger a denial‑of‑service by causing the kernel to crash, potentially taking the entire system offline.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely, requires no user interaction, and compromises confidentiality, integrity, and availability of the system.
What to do about it
- 01Upgrade the Linux kernel to version 6.11 or later, which includes the patch that moves stopping keep‑alive into nvme_uninit_ctrl().
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2024 · Sep 11, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.