CVE-2024-41052

A flaw was found in the Linux kernel's Virtual Function I/O (VFIO) PCI driver. An uninitialized variable during hot-reset device collection causes errors in device counting when retrieving hot-reset information. A local user can exploit this vulnerability to crash userspace processes, resulting in a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local access to VFIO PCI interfaces, and successful exploitation causes a denial of service of user-space processes rather than kernel-level compromise or privilege escalation. VFIO device passthrough is typically configured for specialized virtualization workloads and requires administrative setup, so standard deployments without dedicated PCI device assignment are not exposed. Consequently, the operational blast radius is limited to the specific guest or user-space process managing the hot-reset sequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.