CVE-2024-53681

In the Linux kernel, the following vulnerability has been resolved:

nvmet: Don't overflow subsysnqn

nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string.

Create a new string with kstrndup instead of using the old buffer.

This vulnerability is rated as Moderate severity because exploitation requires local administrative access (such as CAP_SYS_ADMIN) to interact with configfs attributes, significantly restricting exposure. The affected NVMe target subsystem is a specialized storage service that is not configured or loaded by default on Red Hat Enterprise Linux. As a result, standard systems cannot be compromised by unprivileged local users or remote network attackers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.