CVE-2024-50091

In the Linux kernel, the following vulnerability has been resolved:

dm vdo: don't refer to dedupe_context after releasing it

Clear the dedupe_context pointer in a data_vio whenever ownership of the context is lost, so that vdo can't examine it accidentally.

This vulnerability is rated as Moderate severity because exploitation requires local access and privileges to interact with the device mapper VDO deduplication mechanism, limiting the impact to a local denial of service via kernel crash. Supported Red Hat Enterprise Linux releases are not affected, as the upstream dm-vdo driver is not present in their shipping kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.