CVE-2024-27392

A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) host driver. When a namespace identification operation fails, the driver attempts to release the namespace data structure twice, resulting in a double-free condition. A local user could exploit this vulnerability to cause memory corruption, leading to a system crash and Denial of Service (DoS).

This vulnerability is rated as having Low severity because triggering the double-free condition requires an uncommon namespace identification failure during local NVMe device handling, restricting potential impact to a local denial of service. The issue cannot be reached remotely and requires access to host storage management interfaces. Furthermore, supported Red Hat Enterprise Linux releases are not affected, as the vulnerable logic introduced in upstream kernel releases is not present in enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.