CVE-2024-27046: nfp: flower: handle acti_netdevs allocation failure
In the Linux kernel, the following vulnerability has been resolved:
nfp: flower: handle actinetdevs allocation failure
The kmallocarray() in nfpfllagdowork() will return null, if the physical memory has run out. As a result, if we dereference the actinetdevs, the null pointer dereference bugs will happen.
This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfp: flower: handle actinetdevs allocation failure
The Linux kernel CVE team has assigned CVE-2024-27046 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050113-CVE-2024-27046-4694@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27046?
CVE-2024-27046 has a medium severity rating due to its impact on kernel stability.
How do I fix CVE-2024-27046?
To fix CVE-2024-27046, update your Linux kernel to version 4.19.311 or later, or 5.4.273 or later, or 5.10.214 or later, or 5.15.153 or later.
Which Linux kernel versions are affected by CVE-2024-27046?
CVE-2024-27046 affects Linux kernel versions prior to 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, and later versions.
What systems are impacted by CVE-2024-27046?
CVE-2024-27046 impacts systems utilizing the affected versions of the Linux kernel, primarily on Red Hat and Debian distributions.
Is there a workaround for CVE-2024-27046 if I can't update?
Currently, no specific workaround for CVE-2024-27046 is recommended, so it is advised to apply the necessary updates as soon as possible.