CVE-2024-39507CWE-908

CVE-2024-39507

High · published July 12, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash problem in concurrent scenario

When link status change, the nic driver need to notify the roce

driver to handle this event, but at this time, the roce driver

may uninit, then cause kernel crash.

To fix the problem, when link status change, need to check

whether the roce registered, and when uninit, need to wait link

update finish.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2024-07-12T17:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 5.1, < 5.15.1625.15.162
linux/linux_kernel≥ 5.16, < 6.1.956.1.95
linux/linux_kernel≥ 6.2, < 6.6.356.6.35
linux/linux_kernel≥ 6.7, < 6.9.66.9.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (11)
EPSS history
Timeline
  • 12 JUL 12:20Z
    net: hns3: fix kernel crash problem in concurrent scenario
    cvelistv5