CVE-2024-0443
Linux Kernel 6.2 – 6.4
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0443 is a medium-severity Resource Leak (CWE-402) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16238
Vulnerability Data
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the…
more
blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops resources from being reachable by actors outside the intended control sphere.
Explicitly enforces information-flow rules that block private resources from reaching unauthorized external spheres.
Least privilege reduces the set of actors that can reach a resource, limiting wrong-sphere exposure.
Security attributes enable correct sphere assignment and subsequent enforcement decisions.
Boundary controls monitor and restrict communications that would otherwise leak private resources.
Requires confidentiality protection on transmitted data, directly stopping exposure of private resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information-transfer rules can prevent unintended disclosure of private resources outside the product.
Access-control mechanisms limit who can receive resources that should remain internal.
A.5.18 governs the provisioning, review, and revocation of authorized access rights to already-authenticated identities; it has no bearing on whether a product transmits a private resource into an untrusted sphere during its own operation.
Data-leakage-prevention technologies specifically block unintended transmission of sensitive resources.
A.8.3's core (access restriction per policies, per-user/group rights, isolation, dynamic techniques, authentication, time-bound access, encryption, monitoring, alerts) directly stops untrusted parties from exploiting leaked private resources in most transmission scenarios; the bounded remainder is cases where the leak is not an access-control decision at all (e.g. the resource is deliberately public but still contains unintended private data).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.