Threats tagged 'ghsa-66hj-w2gx-rg6c'

CVE-2024-36478 is a medium severity vulnerability in the Linux kernel's null_blk module. It involves a null pointer dereference that occurs when the 'power' and 'submit_queues' parameters are configured concurrently via configfs, leading to a kernel panic. The issue arises due to a race condition between del_gendisk() and blk_mq_update_nr_hw_queues(), which can cause a null pointer dereference. The problem is fixed by using a global mutex to protect the relevant functions from concurrent access.