CVE-2024-27389 (GCVE-0-2024-27389)
Vulnerability from cvelistv5 – Published: 2024-05-01 13:05 – Updated: 2026-08-05 11:29
VLAI
EPSS
VEX
Title
pstore: inode: Only d_invalidate() is needed
Summary
In the Linux kernel, the following vulnerability has been resolved:
pstore: inode: Only d_invalidate() is needed
Unloading a modular pstore backend with records in pstorefs would
trigger the dput() double-drop warning:
WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410
Using the combo of d_drop()/dput() (as mentioned in
Documentation/filesystems/vfs.rst) isn't the right approach here, and
leads to the reference counting problem seen above. Use d_invalidate()
and update the code to not bother checking for error codes that can
never happen.
---
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-09 18:38 UTC
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
609e28bb139e53621521130f0d4aea27a725d465 , < d0ee2a8adb6673382cce8a4280e1ca0849b3b783
(git)
Affected: 609e28bb139e53621521130f0d4aea27a725d465 , < db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e (git) Affected: 609e28bb139e53621521130f0d4aea27a725d465 , < 4cdf9006fc095af71da80e9b5f48a32e991b9ed3 (git) Affected: 609e28bb139e53621521130f0d4aea27a725d465 , < cb9e802e49c24eeb3af35e9e8c04d526f35f112a (git) Affected: 609e28bb139e53621521130f0d4aea27a725d465 , < 340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6 (git) Affected: 609e28bb139e53621521130f0d4aea27a725d465 , < a43e0fc5e9134a46515de2f2f8d4100b74e50de3 (git) |
guessed | |
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.83 , ≤ 6.1.* (semver) Unaffected: 6.6.23 , ≤ 6.6.* (semver) Unaffected: 6.7.11 , ≤ 6.7.* (semver) Unaffected: 6.8.2 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-09T18:38:29.598548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:22:49.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:52.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0ee2a8adb6673382cce8a4280e1ca0849b3b783",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "4cdf9006fc095af71da80e9b5f48a32e991b9ed3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "cb9e802e49c24eeb3af35e9e8c04d526f35f112a",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "a43e0fc5e9134a46515de2f2f8d4100b74e50de3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.83",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.23",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: inode: Only d_invalidate() is needed\n\nUnloading a modular pstore backend with records in pstorefs would\ntrigger the dput() double-drop warning:\n\n WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410\n\nUsing the combo of d_drop()/dput() (as mentioned in\nDocumentation/filesystems/vfs.rst) isn\u0027t the right approach here, and\nleads to the reference counting problem seen above. Use d_invalidate()\nand update the code to not bother checking for error codes that can\nnever happen.\n\n---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability lives in the pstorefs VFS layer (fs/pstore/inode.c) and is reached only through local interfaces \u2014 an open file descriptor on a pstorefs record plus pstore backend teardown (module removal, driver unbind, or MTD device-removal notifier). No network or adjacent-network path exists.\nAC:L - The double-drop is deterministic, not a race: every record belonging to the unregistering backend takes the buggy path unconditionally, and keeping a record file open across teardown is fully under the attacker\u0027s control. No unpredictable memory layout or victim state is required to reach the underflow.\nPR:L - Consistent with this repo\u0027s scoring of driver-removal/rmmod-triggered UAFs, a local unprivileged process supplies the decisive half of the exploit \u2014 holding the fd, then driving slab reclaim of the freed pstore_private/dentry and consuming the primitives via read()/close(); backend unregistration also occurs on non-rmmod paths such as mtdpstore_notify_remove() and platform-driver removal during normal system operation.\nUI:N - No victim action is needed \u2014 the attacker performs the file open, the backend teardown, and the subsequent read()/close() that dereference the freed objects. Nothing requires a second user to interact with the system.\nS:U - The corruption is confined to kernel dcache and slab objects within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is standard in-kernel memory corruption.\nC:H - The premature dentry kill evicts the inode and frees pstore_private/pstore_record/record-\u003ebuf while an open file still points at them via seq_file-\u003eprivate, so pstore_file_read() calls simple_read_from_buffer() with a freed, reclaimable source pointer and length \u2014 a controllable arbitrary kernel-memory read into userspace.\nI:H - The dentry refcount underflow frees the dentry while a file descriptor still holds it, so the later fput()/path_put()/dput() performs lockref decrements and d_child/d_subdirs list manipulation on reclaimed slab memory, yielding a write primitive suitable for heap-spray exploitation.\nA:H - At minimum the bug triggers WARNING at fs/dcache.c:762, which is fatal on the panic_on_warn configurations common in Android, hardened, and cloud kernels; with an open record file it produces a genuine dcache/slab use-after-free that reliably oopses or panics the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:29:24.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0ee2a8adb6673382cce8a4280e1ca0849b3b783"
},
{
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
}
],
"title": "pstore: inode: Only d_invalidate() is needed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-27389",
"datePublished": "2024-05-01T13:05:09.224Z",
"dateReserved": "2024-02-25T13:47:42.676Z",
"dateUpdated": "2026-08-05T11:29:24.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-27389",
"date": "2026-10-06",
"epss": "0.00237",
"percentile": "0.13457"
},
"fkie_nvd": {
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: inode: Only d_invalidate() is needed\n\nUnloading a modular pstore backend with records in pstorefs would\ntrigger the dput() double-drop warning:\n\n WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410\n\nUsing the combo of d_drop()/dput() (as mentioned in\nDocumentation/filesystems/vfs.rst) isn\u0027t the right approach here, and\nleads to the reference counting problem seen above. Use d_invalidate()\nand update the code to not bother checking for error codes that can\nnever happen.\n\n---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pstore: inode: solo se necesita d_invalidate(). La descarga de un backend modular de pstore con registros en pstorefs activar\u00eda la advertencia de doble ca\u00edda de dput(): ADVERTENCIA: CPU: 0 PID: 2569 en fs/dcache.c:762 dput.part.0+0x3f3/0x410 Usar la combinaci\u00f3n de d_drop()/dput() (como se menciona en Documentation/filesystems/vfs.rst) no es el enfoque correcto aqu\u00ed, y conduce al problema de recuento de referencias visto anteriormente. Utilice d_invalidate() y actualice el c\u00f3digo para no molestarse en buscar c\u00f3digos de error que nunca suceder\u00e1n. ---"
}
],
"id": "CVE-2024-27389",
"lastModified": "2024-11-21T09:04:30.670",
"published": "2024-05-01T13:15:51.653",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
},
"microsoft_vex": {
"current_release_date": "2026-09-16T01:51:15.000Z",
"cve": "CVE-2024-27389",
"id": "msrc_CVE-2024-27389",
"initial_release_date": "2025-09-20T01:03:27.000Z",
"product_status:known_affected": "5",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "pstore: inode: Only d_invalidate() is needed",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-27389.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0ee2a8adb6673382cce8a4280e1ca0849b3b783",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "4cdf9006fc095af71da80e9b5f48a32e991b9ed3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "cb9e802e49c24eeb3af35e9e8c04d526f35f112a",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "a43e0fc5e9134a46515de2f2f8d4100b74e50de3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8D30B4C-D66E-4ECB-8103-8CD9DFE724AA",
"versionEndExcluding": "6.1.83",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E00814DC-0BA7-431A-9926-80FEB4A96C68",
"versionEndExcluding": "6.6.23",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD",
"versionEndExcluding": "6.7.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1",
"versionEndExcluding": "6.8.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: inode: Only d_invalidate() is needed\n\nUnloading a modular pstore backend with records in pstorefs would\ntrigger the dput() double-drop warning:\n\n WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410\n\nUsing the combo of d_drop()/dput() (as mentioned in\nDocumentation/filesystems/vfs.rst) isn\u0027t the right approach here, and\nleads to the reference counting problem seen above. Use d_invalidate()\nand update the code to not bother checking for error codes that can\nnever happen.\n\n---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pstore: inode: solo se necesita d_invalidate(). La descarga de un backend modular de pstore con registros en pstorefs activar\u00eda la advertencia de doble ca\u00edda de dput(): ADVERTENCIA: CPU: 0 PID: 2569 en fs/dcache.c:762 dput.part.0+0x3f3/0x410 Usar la combinaci\u00f3n de d_drop()/dput() (como se menciona en Documentation/filesystems/vfs.rst) no es el enfoque correcto aqu\u00ed, y conduce al problema de recuento de referencias visto anteriormente. Utilice d_invalidate() y actualice el c\u00f3digo para no molestarse en buscar c\u00f3digos de error que nunca suceder\u00e1n. ---"
}
],
"id": "CVE-2024-27389",
"lastModified": "2026-08-04T11:17:41.550",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-27389",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-09T18:38:29.598548Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-05-01T13:15:51.653",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d0ee2a8adb6673382cce8a4280e1ca0849b3b783"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-415"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-04T22:47:55+00:00",
"cve": "CVE-2024-27389",
"id": "CVE-2024-27389",
"initial_release_date": "2024-05-01T00:00:00+00:00",
"product_status:fixed": "280",
"product_status:known_affected": "64",
"product_status:known_not_affected": "56",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: pstore: inode: Only d_invalidate() is needed",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27389.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-19T02:35:45Z",
"cve": "CVE-2024-27389",
"id": "CVE-2024-27389",
"initial_release_date": "2024-05-03T02:09:31Z",
"product_status:known_affected": "271",
"product_status:known_not_affected": "200",
"product_status:recommended": "819",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-27389",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27389.json",
"version": "114"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:52.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-09T18:38:29.598548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T15:20:44.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0ee2a8adb6673382cce8a4280e1ca0849b3b783",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "4cdf9006fc095af71da80e9b5f48a32e991b9ed3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "cb9e802e49c24eeb3af35e9e8c04d526f35f112a",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
},
{
"lessThan": "a43e0fc5e9134a46515de2f2f8d4100b74e50de3",
"status": "affected",
"version": "609e28bb139e53621521130f0d4aea27a725d465",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pstore/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.83",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.23",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: inode: Only d_invalidate() is needed\n\nUnloading a modular pstore backend with records in pstorefs would\ntrigger the dput() double-drop warning:\n\n WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410\n\nUsing the combo of d_drop()/dput() (as mentioned in\nDocumentation/filesystems/vfs.rst) isn\u0027t the right approach here, and\nleads to the reference counting problem seen above. Use d_invalidate()\nand update the code to not bother checking for error codes that can\nnever happen.\n\n---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability lives in the pstorefs VFS layer (fs/pstore/inode.c) and is reached only through local interfaces \u2014 an open file descriptor on a pstorefs record plus pstore backend teardown (module removal, driver unbind, or MTD device-removal notifier). No network or adjacent-network path exists.\nAC:L - The double-drop is deterministic, not a race: every record belonging to the unregistering backend takes the buggy path unconditionally, and keeping a record file open across teardown is fully under the attacker\u0027s control. No unpredictable memory layout or victim state is required to reach the underflow.\nPR:L - Consistent with this repo\u0027s scoring of driver-removal/rmmod-triggered UAFs, a local unprivileged process supplies the decisive half of the exploit \u2014 holding the fd, then driving slab reclaim of the freed pstore_private/dentry and consuming the primitives via read()/close(); backend unregistration also occurs on non-rmmod paths such as mtdpstore_notify_remove() and platform-driver removal during normal system operation.\nUI:N - No victim action is needed \u2014 the attacker performs the file open, the backend teardown, and the subsequent read()/close() that dereference the freed objects. Nothing requires a second user to interact with the system.\nS:U - The corruption is confined to kernel dcache and slab objects within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is standard in-kernel memory corruption.\nC:H - The premature dentry kill evicts the inode and frees pstore_private/pstore_record/record-\u003ebuf while an open file still points at them via seq_file-\u003eprivate, so pstore_file_read() calls simple_read_from_buffer() with a freed, reclaimable source pointer and length \u2014 a controllable arbitrary kernel-memory read into userspace.\nI:H - The dentry refcount underflow frees the dentry while a file descriptor still holds it, so the later fput()/path_put()/dput() performs lockref decrements and d_child/d_subdirs list manipulation on reclaimed slab memory, yielding a write primitive suitable for heap-spray exploitation.\nA:H - At minimum the bug triggers WARNING at fs/dcache.c:762, which is fatal on the panic_on_warn configurations common in Android, hardened, and cloud kernels; with an open record file it produces a genuine dcache/slab use-after-free that reliably oopses or panics the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:29:24.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0ee2a8adb6673382cce8a4280e1ca0849b3b783"
},
{
"url": "https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e"
},
{
"url": "https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3"
},
{
"url": "https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a"
},
{
"url": "https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6"
},
{
"url": "https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3"
}
],
"title": "pstore: inode: Only d_invalidate() is needed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-27389",
"datePublished": "2024-05-01T13:05:09.224Z",
"dateReserved": "2024-02-25T13:47:42.676Z",
"dateUpdated": "2026-08-05T11:29:24.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…