CVE-2024-26824

A flaw was found in the Linux kernel's crypto subsystem. When processing zero-length messages in the hash algorithm interface (algif_hash), an error condition causes the kernel to attempt to free an unallocated scatter-gather list (SGL) buffer. A local attacker could exploit this vulnerability to trigger memory corruption, potentially leading to a system crash and Denial of Service (DoS).

This vulnerability is rated as Low severity because successful exploitation requires local privileges to interact with user-space cryptographic interfaces and is limited to causing a denial of service via a kernel panic. Supported releases of Red Hat Enterprise Linux are unaffected, as the problematic error-handling code path was introduced in upstream kernel version 6.5 and is absent from RHEL kernel builds. On systems running newer upstream kernels where this code is present, the impact is confined to local system crashes without compromising confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.