CVE-2024-41149

In the Linux kernel, the following vulnerability has been resolved:

block: avoid to reuse hctx not removed from cpuhp callback list

If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it, otherwise use-after-free may be triggered.

This vulnerability is evaluated as Moderate severity because successful exploitation requires local administrative privileges to trigger block hardware queue reconfigurations alongside CPU hotplug transitions. In standard Red Hat Enterprise Linux deployments, unprivileged users lack access to reconfigure block devices or manipulate CPU hotplug callbacks, restricting the blast radius to a local denial of service or potential privilege escalation. Consequently, the flaw cannot be exploited remotely or by default unprivileged accounts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.