GHSA-rqh4-x2v7-j34g

GHSA-rqh4-x2v7-j34g PUBLISHED CVSS 5.5 MEDIUM

Record from GitHub Advisory Database · Published January 12, 2024

A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.

Risk scores

CVSS 3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Timeline

Jan 12, 2024 CVE Published
Apr 10, 2026 Distribution Patch (3 in total, the first dated here)
Apr 10, 2026 Security Advisory (4 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-rqh4-x2v7-j34g
vulnetix vdb fixes GHSA-rqh4-x2v7-j34g

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-rqh4-x2v7-j34g/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →