CVE-2024-35979

In the Linux kernel, the following vulnerability has been resolved:

raid1: fix use-after-free for original bio in raid1_write_request()

The Linux kernel CVE team has assigned CVE-2024-35979 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-35979-2618@gregkh/T

Red Hat has evaluated this vulnerability as having a Low security impact because exploitation requires local access and specific software RAID1 storage configurations encountering blocked underlying devices. The failure condition triggers premature deallocation of the primary I/O request buffer during write processing, resulting in a denial of service via a kernel panic. Systems that do not configure software RAID1 arrays or do not permit unprivileged users to issue direct block writes remain unaffected in typical operational environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.