CVE-2024-26764

A flaw was found in the Linux kernel. This vulnerability affects the asynchronous I/O (AIO) system. The vulnerability arises when the kiocb_set_cancel_fn() function is incorrectly applied to I/O submitted via io_uring instead of being limited to I/O submitted via libaio. This issue can lead to a kernel warning that causes instability in the system. The kernel warning occurs because the function isn't designed to handle io_uring submissions, leading to potential disruptions. The vulnerability impacts older kernel versions but has been addressed by restricting the function to appropriate use cases.

This vulnerability is classified as Moderate impact for Red Hat Enterprise Linux because exploitation requires local unprivileged access to trigger concurrent asynchronous I/O paths on specialized endpoints, limiting the blast radius primarily to non-fatal kernel warnings. While triggering the issue may disrupt system stability if the host is configured to treat kernel warnings as fatal errors, it does not allow privilege escalation or confidential data disclosure. Under typical Red Hat enterprise configurations, the prerequisite device interfaces and asynchronous cancel operations are not exposed to untrusted users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.