Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.
Summary
| CVE | CVE-2024-0443 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-12 00:15:45 UTC |
| Updated | 2026-07-21 19:17:08 UTC |
| Description | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.002470000 probability, percentile 0.160790000 (date 2026-07-21)
Problem Types: CWE-402 | CWE-668 | CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 39 | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc1 | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc2 | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc3 | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc4 | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc5 | All | All |
| Operating System | Linux | Linux Kernel | 6.4 | rc6 | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:4.18.0-513.5.1.el8_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:5.14.0-284.40.1.el9_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2023:6583 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2023:7370 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| [PATCH v4 2/2] blk-cgroup: Flush stats at blkgs destruction path - Waiman Long | af854a3a-2127-422b-91ae-364da2661108 | lore.kernel.org | Mailing List |
| 2257968 – (CVE-2024-0443) CVE-2024-0443 kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Jay Shin (Red Hat). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-11T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2023-12-14T00:00:00.000Z | Made public. |
Workarounds
CNA: This flaw can be mitigated with the possible workaround identified below: - systemd.unified_cgroup_hierarchy=1 or - cgroup_disable=blkio
There are currently no legacy QID mappings associated with this CVE.