CVE-2024-35809

A vulnerability was found in the PCI subsystem in the Linux kernel, where runtime-idle callbacks are not always drained before a PCI driver is removed. If these callbacks are still active when the driver is removed, it could result in system instability or crashes.

This vulnerability is rated as Moderate because triggering the condition requires device unbinding or module unloading, operations that generally necessitate elevated privileges or physical hardware manipulation. A race condition between runtime power management callbacks and PCI device teardown can trigger an unhandled page fault, leading to a local denial of service through a system crash. While the flaw disrupts system availability, it does not grant privilege escalation or allow unauthorized access to confidential data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.