A memory management error in the Linux kernel crypto ccp driver can lead to a system crash when invalid deallocation occurs.

The vulnerability arises from the improper use of the __cleanup(kfree) attribute on a local pointer variable in the crypto ccp driver. This causes the kernel to attempt to free the address of the local variable itself rather than the buffer returned by kmalloc, leading to a crash due to invalid deallocation.

This vulnerability poses a risk of denial-of-service (DoS) as a local attacker could trigger the crash by interacting with the affected crypto driver. With a CVSS score of 7.8, this is considered a high-severity issue that could disrupt operations on systems utilizing specific hardware-accelerated cryptographic functions.

Immediate Action: Apply the latest kernel security patches from your OS vendor to resolve the incorrect cleanup attribute usage.

Proactive Monitoring: Review system logs for frequent driver crashes or unexpected reboots associated with cryptographic module initialization.

Compensating Controls: If patching is delayed, disable or blacklist the affected crypto driver if it is not required for system functionality.

Public Exploit Available: false

The risk of immediate system crash necessitates timely remediation. Organizations should verify their kernel versions against vendor security bulletins and apply the necessary updates to prevent potential service disruption caused by this memory management error.