CVE-2024-36004

A flaw was found in the Linux kernel's i40e network driver. This vulnerability can lead to a Denial of Service (DoS) due to an improper task scheduling dependency between the i40e driver and the i40iw module. When both drivers are active, a memory-reclaim work queue flushes a dependent task queue that lacks memory reclamation guarantees. A local user initiating network device state changes can trigger this condition, potentially leading to a kernel deadlock under memory pressure.

This vulnerability is rated as Low severity for Red Hat Enterprise Linux because exploitation is restricted to local environments and requires uncommon hardware and software configurations. The issue only manifests on systems utilizing Intel 700 series network adapters with both the i40e Ethernet and i40iw RDMA modules simultaneously loaded and active. Furthermore, triggering the condition necessitates local privileges to initiate interface state modifications during severe system memory exhaustion, resulting at most in a denial of service without compromising data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.