CVE-2024-46828

A flaw was found in the sch_cake component of the Linux kernel. A local attacker could exploit a vulnerability in the bulk flow accounting logic, specifically during hash collision handling when host fairness is disabled. This can lead to an array out-of-bounds write due to a spurious decrement and wrap-around of a counter. If the qdisc (queueing discipline) is subsequently reconfigured to enable host fairness, the retained wrapped-around value is used as an array index, potentially causing a denial of service or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.