CVE-2024-46823

A flaw was found in the Linux kernel before initialization in subsystem tests. The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope, however, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register', which can produce a kernel panic with KASAN enabled. This could allow a local user to crash the system.

This vulnerability is rated as Low impact because it is restricted to internal KUnit test executions and requires elevated administrative privileges to trigger. In standard Red Hat Enterprise Linux environments, test modules are not loaded during normal operations, and production kernels are compiled without KASAN enabled. Consequently, unprivileged local users cannot independently invoke the flawed test routines to cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.