CVE-2024-35925

In the Linux kernel, the following vulnerability has been resolved:

block: prevent division by zero in blk_rq_stat_sum()

The Linux kernel CVE team has assigned CVE-2024-35925 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35925-fa17@gregkh/T

This vulnerability is rated as Low severity because triggering the integer overflow in the block statistics subsystem requires accumulating an extraordinary volume of I/O request samples, making exploitation highly impractical in standard enterprise environments. Even if an overflow condition were reached, it would only result in a local denial of service via a kernel panic without compromising system confidentiality or integrity. Furthermore, normal user workloads do not generate the preconditions necessary to cause this arithmetic overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.