CVE-2024-38598

A flaw was found in the Linux kernel's Multiple Device (md) subsystem. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by triggering a system hang. The issue occurs during Redundant Array of Independent Disks (RAID) resynchronization when the tracking bitmap size is smaller than the array size, creating an infinite loop that locks up the processor.

This vulnerability is rated as Moderate because exploitation requires local access and specific storage administrative operations, limiting the impact to a denial of service without compromising system confidentiality or integrity. The issue manifests in the Linux kernel Multiple Device driver during resynchronization of an array when the tracking bitmap size is smaller than the underlying storage size, resulting in an infinite loop that causes a CPU soft lockup. Standard deployments that do not perform synchronization actions on mismatched RAID structures remain unaffected during ordinary operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.