#VU92042 Improper locking in Linux kernel - CVE-2024-26743

Vulnerability identifier: #VU92042

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26743

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qedr_create_user_qp() function in drivers/infiniband/hw/qedr/verbs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/5639414a52a29336ffa1ede80a67c6d927acbc5a
https://git.kernel.org/stable/c/135e5465fefa463c5ec93c4eede48b9fedac894a
https://git.kernel.org/stable/c/7f31a244c753aacf40b71d01f03ca6742f81bbbc
https://git.kernel.org/stable/c/95175dda017cd4982cd47960536fa1de003d3298
https://git.kernel.org/stable/c/bab8875c06ebda5e01c5c4cab30022aed85c14e6
https://git.kernel.org/stable/c/5ba4e6d5863c53e937f49932dee0ecb004c65928

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.