CVE-2024-40998

A vulnerability was found in the Linux kernel's ext4 filesystem within the __ext4_fill_super() function, where uninitialized access to ratelimit_state->lock can occur, where the sysfs interface is registered before properly initializing rs->lock, potentially allowing other processes to modify rs->interval to a non-zero value.

A moderate severity flaw was found in the Linux kernel's ext4 filesystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 as well as the kernels used by Red Hat managed OpenShift offerings. When an ext4 filesystem is mounted, __ext4_fill_super() registers the ext4 sysfs interface, which exposes the msg_ratelimit_interval_ms parameter, before the filesystem's message ratelimit state (s_msg_ratelimit_state) and its spinlock are initialized. A privileged local user can exploit this race by setting the message rate limit interval to a non-zero value through sysfs while the lock is still uninitialized; a subsequent call to ext4_msg(), such as those issued during orphan cleanup, then accesses the uninitialized ratelimit_state->lock. As demonstrated upstream, this triggers a lockdep warning that turns off the locking correctness validator, and operating on an uninitialized spinlock can affect kernel stability and system availability. The flaw has no confidentiality or integrity impact. The Red Hat severity of Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with the upstream NIST rating, and Fedora is recorded as not affected. The fix is delegated to the Red Hat Enterprise Linux kernel team, and affected streams are addressed through the standard update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.