CVE-2024-43871

A flaw was found in the Linux kernel's device resource management (devres) component. When devm_free_percpu() is invoked to release allocated per-CPU memory, the kernel fails to free the underlying memory resources properly. A local user could exploit this flaw to continuously leak system memory, potentially resulting in resource exhaustion and a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux environments because exploitation is limited to a local denial-of-service condition without permitting privilege escalation or arbitrary code execution. The issue stems from improper deallocation in the kernel's managed device resource framework when specific drivers release per-CPU allocations during device detachment or driver unbind operations. Triggering this condition typically requires repeated interactions with hardware or device interfaces that invoke the affected driver routines, restricting exposure to local users capable of initiating such operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.