CVE-2024-47687

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0-496.el9.x86 64

Description The Linux kernel has a vulnerability in the vdpa/mlx5 module, where certain error paths from mlx5 vdpa dev add() can release mr resources that were never initialized. This issue is resolved by adding a missing check in mlx5 vdpa destroy mr resources() to block the release of non-initialized mr resources. The vulnerability can cause a kernel NULL pointer dereference.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.