CVE-2024-42249

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. Premature cleanup occurs during asynchronous transfer handling when a message is still queued and waiting to be transferred. A local user could exploit this flaw to cause message corruption while the data is actively being processed by the controller driver.

This flaw is evaluated as a Low severity risk by Red Hat because exploitation necessitates local system access and interaction with specialized Serial Peripheral Interface hardware or emulated devices. On typical enterprise installations, access to low-level hardware buses is restricted to privileged administrators, significantly limiting an attacker's reach. Furthermore, the issue only induces transfer data corruption without granting code execution or compromising confidential memory contents.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.