CVE-2024-56715

In the Linux kernel, the following vulnerability has been resolved:

ionic: Fix netdev notifier unregister on failure

If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.

A flaw was found in the Linux kernel's Pensando ionic network driver. If register_netdev() fails while an ionic network interface is being initialized, the driver does not unregister its network device notifier (nor an already-registered PTP hardware clock), resulting in a kernel memory leak. Red Hat rates this flaw as having low security impact: the flaw is only reachable on a device-registration error path, requires local privileged access on systems with ionic hardware, and its consequence is limited to gradual kernel memory consumption rather than a direct confidentiality or integrity impact. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 are affected; the fix has been deferred to a future update because of the low severity and the impractical nature of triggering this path, leaving a residual risk of slow memory growth on systems that repeatedly hit the ionic interface registration failure path. Red Hat Enterprise Linux 6 and 7 are not affected because the flawed code was introduced upstream in kernel version 5.10, later than the kernels shipped in those releases, and the Red Hat Enterprise Linux 8 streams listed on this flaw are out of support scope. The higher CVSS score in the upstream CVEORG record (7.8) differs from Red Hat's rating because that record assumes high confidentiality and integrity impact, whereas this issue is a bounded error-path resource leak, consistent with the lower NIST rating of 5.5.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.