CVE-2024-42250 (GCVE-0-2024-42250)

Vulnerability from cvelistv5 – Published: 2024-08-07 15:14 – Updated: 2026-08-05 11:36
VLAI
Title
cachefiles: add missing lock protection when polling
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tree is ensured to be pinned there, while the data structure (e.g. struct cachefiles_req) stored in the slot has no such guarantee. The poll routine will iterate the radix tree and dereference cachefiles_req accordingly. Thus RCU read lock is not adequate in this case and spinlock is needed here.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0e19a18f998dcabe8be590e0b39660a1f230209b , < 97cfd5e20ddc2e33e16ce369626ce76c9a475fd7 (git)
Affected: 18943864342705fa18dd4e6b8d608491fec81f6e , < 6bb6bd3dd6f382dfd36220d4b210a0c77c066651 (git)
Affected: b817e22b2e91257ace32a6768c3c003faeaa1c5c , < 8eadcab7f3dd809edbe5ae20533ff843dfea3a07 (git)
Affected: b817e22b2e91257ace32a6768c3c003faeaa1c5c , < cf5bb09e742a9cf6349127e868329a8f69b7a014 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:18.948935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:30.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:02:51.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/daemon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97cfd5e20ddc2e33e16ce369626ce76c9a475fd7",
              "status": "affected",
              "version": "0e19a18f998dcabe8be590e0b39660a1f230209b",
              "versionType": "git"
            },
            {
              "lessThan": "6bb6bd3dd6f382dfd36220d4b210a0c77c066651",
              "status": "affected",
              "version": "18943864342705fa18dd4e6b8d608491fec81f6e",
              "versionType": "git"
            },
            {
              "lessThan": "8eadcab7f3dd809edbe5ae20533ff843dfea3a07",
              "status": "affected",
              "version": "b817e22b2e91257ace32a6768c3c003faeaa1c5c",
              "versionType": "git"
            },
            {
              "lessThan": "cf5bb09e742a9cf6349127e868329a8f69b7a014",
              "status": "affected",
              "version": "b817e22b2e91257ace32a6768c3c003faeaa1c5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/daemon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add missing lock protection when polling\n\nAdd missing lock protection in poll routine when iterating xarray,\notherwise:\n\nEven with RCU read lock held, only the slot of the radix tree is\nensured to be pinned there, while the data structure (e.g. struct\ncachefiles_req) stored in the slot has no such guarantee.  The poll\nroutine will iterate the radix tree and dereference cachefiles_req\naccordingly.  Thus RCU read lock is not adequate in this case and\nspinlock is needed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven through local file I/O on an EROFS-over-fscache on-demand mount and the local `/dev/cachefiles` daemon interface; no network-supplied data reaches the vulnerable poll iterator.\nAC:L - The attacker creates both sides of the race \u2014 each cache-miss read allocates a request and calls `wake_up_all(\u0026cache-\u003edaemon_pollwq)`, forcing the daemon into the unlocked xarray walk, and the same task performs the `kfree(req)` on completion \u2014 and can retry indefinitely while heap-spraying the freed slab.\nPR:L - An unprivileged local user or container tenant only needs read access to files on the already-mounted on-demand cache; the CAP_SYS_ADMIN-held daemon fd is a normal running service in these deployments, not something the attacker must obtain.\nUI:N - No victim action is required \u2014 the cachefiles daemon polls continuously as part of its normal operation and is woken automatically by the attacker\u0027s own request submissions.\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `req-\u003eobject` is at offset 0 of the freed object, so a reallocated/sprayed slab yields an attacker-chosen pointer that is dereferenced twice, and the resulting `state` comparison is leaked back as the EPOLLIN bit \u2014 a repeatable arbitrary-address read oracle.\nI:H - A slab use-after-free with a fully attacker-controllable first-field pointer is a classic primitive for heap grooming and control-flow/data corruption, so integrity impact is High per use-after-free handling.\nA:H - Dereferencing the stale or wild `req-\u003eobject` chain reliably produces a kernel oops/panic, taking down the host or container node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:04.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651"
        },
        {
          "url": "https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014"
        }
      ],
      "title": "cachefiles: add missing lock protection when polling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42250",
    "datePublished": "2024-08-07T15:14:33.997Z",
    "dateReserved": "2024-07-30T07:40:12.256Z",
    "dateUpdated": "2026-08-05T11:36:04.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42250",
      "date": "2026-08-09",
      "epss": "0.00172",
      "percentile": "0.06802"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.9.10\", \"matchCriteriaId\": \"6FAC1A24-181A-4DB7-801D-4BDF1B4E4116\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add missing lock protection when polling\\n\\nAdd missing lock protection in poll routine when iterating xarray,\\notherwise:\\n\\nEven with RCU read lock held, only the slot of the radix tree is\\nensured to be pinned there, while the data structure (e.g. struct\\ncachefiles_req) stored in the slot has no such guarantee.  The poll\\nroutine will iterate the radix tree and dereference cachefiles_req\\naccordingly.  Thus RCU read lock is not adequate in this case and\\nspinlock is needed here.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: archivos de cach\\u00e9: agregue protecci\\u00f3n de bloqueo faltante al sondear. Agregue protecci\\u00f3n de bloqueo faltante en la rutina de sondeo al iterar xarray; de lo contrario: incluso con el bloqueo de lectura de RCU mantenido, solo se garantiza que la ranura del \\u00e1rbol de base ser anclado all\\u00ed, mientras que la estructura de datos (por ejemplo, struct cachefiles_req) almacenada en la ranura no tiene tal garant\\u00eda. La rutina de sondeo iterar\\u00e1 el \\u00e1rbol de base y eliminar\\u00e1 la referencia a cachefiles_req en consecuencia. Por lo tanto, el bloqueo de lectura de la RCU no es adecuado en este caso y aqu\\u00ed se necesita el bloqueo de giro.\"}]",
      "id": "CVE-2024-42250",
      "lastModified": "2024-08-08T20:55:19.780",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-07T16:15:47.567",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-667\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-07T16:15:47.567\",\"lastModified\":\"2026-08-04T11:19:42.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add missing lock protection when polling\\n\\nAdd missing lock protection in poll routine when iterating xarray,\\notherwise:\\n\\nEven with RCU read lock held, only the slot of the radix tree is\\nensured to be pinned there, while the data structure (e.g. struct\\ncachefiles_req) stored in the slot has no such guarantee.  The poll\\nroutine will iterate the radix tree and dereference cachefiles_req\\naccordingly.  Thus RCU read lock is not adequate in this case and\\nspinlock is needed here.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: archivos de cach\u00e9: agregue protecci\u00f3n de bloqueo faltante al sondear. Agregue protecci\u00f3n de bloqueo faltante en la rutina de sondeo al iterar xarray; de lo contrario: incluso con el bloqueo de lectura de RCU mantenido, solo se garantiza que la ranura del \u00e1rbol de base ser anclado all\u00ed, mientras que la estructura de datos (por ejemplo, struct cachefiles_req) almacenada en la ranura no tiene tal garant\u00eda. La rutina de sondeo iterar\u00e1 el \u00e1rbol de base y eliminar\u00e1 la referencia a cachefiles_req en consecuencia. Por lo tanto, el bloqueo de lectura de la RCU no es adecuado en este caso y aqu\u00ed se necesita el bloqueo de giro.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/daemon.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0e19a18f998dcabe8be590e0b39660a1f230209b\",\"lessThan\":\"97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"18943864342705fa18dd4e6b8d608491fec81f6e\",\"lessThan\":\"6bb6bd3dd6f382dfd36220d4b210a0c77c066651\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b817e22b2e91257ace32a6768c3c003faeaa1c5c\",\"lessThan\":\"8eadcab7f3dd809edbe5ae20533ff843dfea3a07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b817e22b2e91257ace32a6768c3c003faeaa1c5c\",\"lessThan\":\"cf5bb09e742a9cf6349127e868329a8f69b7a014\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/daemon.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:13:18.948935Z\",\"id\":\"CVE-2024-42250\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"6FAC1A24-181A-4DB7-801D-4BDF1B4E4116\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:28:06+00:00",
      "cve": "CVE-2024-42250",
      "id": "CVE-2024-42250",
      "initial_release_date": "2024-08-07T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "232",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cachefiles: add missing lock protection when polling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42250.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:54:34Z",
      "cve": "CVE-2024-42250",
      "id": "CVE-2024-42250",
      "initial_release_date": "2024-08-08T02:20:10Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "248",
      "product_status:recommended": "360",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42250",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42250.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:02:51.030Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42250\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:13:18.948935Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.105Z\"}}], \"cna\": {\"title\": \"cachefiles: add missing lock protection when polling\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0e19a18f998dcabe8be590e0b39660a1f230209b\", \"lessThan\": \"97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"18943864342705fa18dd4e6b8d608491fec81f6e\", \"lessThan\": \"6bb6bd3dd6f382dfd36220d4b210a0c77c066651\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b817e22b2e91257ace32a6768c3c003faeaa1c5c\", \"lessThan\": \"8eadcab7f3dd809edbe5ae20533ff843dfea3a07\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b817e22b2e91257ace32a6768c3c003faeaa1c5c\", \"lessThan\": \"cf5bb09e742a9cf6349127e868329a8f69b7a014\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/daemon.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/daemon.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\"}, {\"url\": \"https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651\"}, {\"url\": \"https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07\"}, {\"url\": \"https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add missing lock protection when polling\\n\\nAdd missing lock protection in poll routine when iterating xarray,\\notherwise:\\n\\nEven with RCU read lock held, only the slot of the radix tree is\\nensured to be pinned there, while the data structure (e.g. struct\\ncachefiles_req) stored in the slot has no such guarantee.  The poll\\nroutine will iterate the radix tree and dereference cachefiles_req\\naccordingly.  Thus RCU read lock is not adequate in this case and\\nspinlock is needed here.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:25:05.414Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42250\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:02:51.030Z\", \"dateReserved\": \"2024-07-30T07:40:12.256Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-07T15:14:33.997Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.