CVE-2024-41096

A use after free vulnerability was found in the Linux Kernel. Failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init(), which accesses the descriptor for unmasking in the error exit path, leading to a loss of confidentiality, integrity, and availability.

A use-after-free flaw was found in the Linux kernel's PCI/MSI interrupt setup path, which Red Hat assessed as having MODERATE impact. When a PCI device enables MSI interrupts and the underlying MSI domain allocation fails, msi_capability_init() frees the MSI descriptor, yet its error exit path then accesses that already-freed descriptor for unmasking, resulting in a use-after-free read that could lead to a loss of confidentiality, integrity, and availability. Red Hat scored this flaw CVSS 6.7 (AV:L/AC:L/PR:H), rating it MODERATE rather than the NIST/CVE.org score of 7.8, because triggering the vulnerable path requires local access with high privileges on a system where MSI interrupt allocation can be made to fail. Within Red Hat's product portfolio, this flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 update streams, for which fixes are being pursued through the delegated maintenance process, as well as the kernel in Fedora. Red Hat Enterprise Linux 6, 7, and 8, and the Hosted OpenShift cluster offerings (ARO and OSD), are not affected because the affected reworked PCI/MSI descriptor allocation code is not present in the kernel versions they ship. The upstream fix addresses the issue by using a copy of the MSI descriptor for the error exit path unmask operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.