CVE-2024-58004

A flaw was found in the Linux kernel's Intel IPU6 driver. A local user could trigger this vulnerability to cause a Denial of Service (DoS) through a system crash. The issue occurs because the driver fails to remove CPU latency Quality of Service (QoS) requests during error handling before releasing associated memory, resulting in linked list corruption within the kernel power management subsystem.

This vulnerability is rated as Moderate severity because exploitation requires local access and is restricted to systems equipped with Intel IPU6 hardware, limiting the blast radius to a local denial of service via a system crash. Within the Intel IPU6 driver subsystem, failure to properly remove latency requests during error recovery leads to list corruption in the kernel power management framework. Enterprise platforms such as Red Hat Enterprise Linux 8 and 9 are unaffected as they do not include this driver code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.