CVE-2024-39486

A race condition was found in the Linux kernel. The rm_file_update_pid() only increments the refcount of a struct pid after storing a pointer to it in filp->pid, dropping the dev->filelist_mutex, resulting in a use-after-free vulnerability.

A moderate-severity use-after-free vulnerability was found in the Linux kernel DRM subsystem. drm_file_update_pid() stored a pointer to a struct pid in filp->pid and dropped dev->filelist_mutex before incrementing that pid's refcount, so two processes racing through drm_file_update_pid() could cause a struct pid to reach refcount zero and be freed while another process still held a reference to it, resulting in a use-after-free. A local user with access to a DRM device could trigger this race to crash the system (denial of service); the race is considered difficult to hit and, per the upstream advisory, requires a kernel built with CONFIG_PREEMPT_RCU. Red Hat rates this flaw as Moderate impact because the race condition cannot result in loss of confidentiality or integrity (RH CVSS 5.5, availability-only impact), which is lower than the severity assigned by NIST (7.0) and the CVE.org record (7.8). Within Red Hat's product portfolio, the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 are affected and fixes are being pursued through the Red Hat kernel team; Red Hat Enterprise Linux 8, Red Hat managed OpenShift (OSD and ARO) offerings, and Fedora are not affected, while the Red Hat Enterprise Linux 6 and 7 ELS streams are out of active support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.