CVE-2024-54458

A flaw was found in the Universal Flash Storage (UFS) subsystem of the Linux kernel. The driver fails to reset the block SCSI generic (BSG) queue pointer to NULL after removal, leaving a dangling pointer. A local user could exploit this condition to cause a use-after-free access, potentially leading to a Denial of Service (DoS) via a system crash.

This vulnerability is rated as a Low severity issue for Red Hat environments because exploiting it requires local system access and physical or emulated Universal Flash Storage (UFS) host controllers, which are uncommon in standard enterprise server deployments. Furthermore, triggering the underlying memory cleanup condition requires dynamic removal of the associated storage device interface, which is rarely performed during normal operations. Even if triggered by an authenticated local user with appropriate privileges, the consequence is primarily limited to kernel memory corruption leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.