CVE-2024-40947

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). This vulnerability allows a local user to cause a denial of service (DoS) by crashing the system. The issue occurs because a memory allocation within a Read-Copy Update (RCU) critical section can sleep unexpectedly, violating kernel synchronization guarantees. As a result, concurrent policy rule operations can trigger a use-after-free memory error during integrity policy evaluation.

This vulnerability is classified as having a Low severity impact because triggering the condition requires local privileges to alter policies alongside precise race conditions during integrity rule processing. In standard Red Hat Enterprise Linux environments, active Integrity Measurement Architecture (IMA) rule management is not enabled by default for unprivileged workloads, substantially minimizing exposure. Furthermore, the blast radius is restricted to a local denial of service via a kernel crash, without compromising confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.