CVE-2024-38385

A flaw was found in the Linux kernel. A race condition in the interrupt descriptor subsystem allows an interrupt descriptor to be accessed without proper locking, leading to a use-after-free condition where memory is referenced after being released. A local user could exploit this flaw by querying system interrupt statistics, potentially triggering a system crash and causing a Denial of Service (DoS).

This vulnerability is assessed as Low impact because exploitation is confined to a local denial of service, requiring precise timing to trigger a race condition during dynamic interrupt deallocation and concurrent statistics queries. The flaw cannot be leveraged for arbitrary privilege escalation or unauthorized data disclosure, as it only results in a kernel crash. Additionally, typical enterprise platforms do not ship the upstream interrupt subsystem refactoring that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.