Lucene search

K
cveMITRECVE-2024-26872
HistoryApr 17, 2024 - 10:27 a.m.

CVE-2024-26872

2024-04-1710:27:32
MITRE
web.nvd.nist.gov
30
linux kernel
vulnerability
cve-2024-26872
event handler
rdma/srpt
use-after-free
write

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.7%

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Do not register event handler until srpt device is fully setup

Upon rare occasions, KASAN reports a use-after-free Write
in srpt_refresh_port().

This seems to be because an event handler is registered before the
srpt device is fully setup and a race condition upon error may leave a
partially setup event handler in place.

Instead, only register the event handler after srpt device initialization
is complete.

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.7%