CVE-2024-42075 (GCVE-0-2024-42075)

Vulnerability from cvelistv5 – Published: 2024-07-29 15:52 – Updated: 2026-08-05 11:35
VLAI
Title
bpf: Fix remap of arena.
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix remap of arena. The bpf arena logic didn't account for mremap operation. Add a refcnt for multiple mmap events to prevent use-after-free in arena_vm_close.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:19 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 317460317a02a1af512697e6e964298dedd8a163 , < 87496a1b01e8e2e399428c0db25e106f7961d01e (git)
Affected: 317460317a02a1af512697e6e964298dedd8a163 , < b90d77e5fd784ada62ddd714d15ee2400c28e1cf (git)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.9.8 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.802Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:19:30.060305Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:57.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/arena.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87496a1b01e8e2e399428c0db25e106f7961d01e",
              "status": "affected",
              "version": "317460317a02a1af512697e6e964298dedd8a163",
              "versionType": "git"
            },
            {
              "lessThan": "b90d77e5fd784ada62ddd714d15ee2400c28e1cf",
              "status": "affected",
              "version": "317460317a02a1af512697e6e964298dedd8a163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/arena.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix remap of arena.\n\nThe bpf arena logic didn\u0027t account for mremap operation. Add a refcnt for\nmultiple mmap events to prevent use-after-free in arena_vm_close."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the bpf(2) syscall (map creation or BPF_OBJ_GET on a bpffs pin) followed by mmap()/mremap()/fork() on the arena map fd, all of which require local access to the system. There is no network-facing path into kernel/bpf/arena.c.\nAC:L - Triggering is fully deterministic with no race involved \u2014 mmap the arena, then either fork() and let both processes exit, or mremap() the VMA to a new address and unmap it, and arena_vm_close() runs twice on the same vma_list object. No unusual kernel config is needed since arena.c is built with CONFIG_BPF_SYSCALL.\nPR:L - The trigger (mmap/mremap/fork on an arena map fd) needs no privileges at all, and an fd can be obtained by an unprivileged process via a bpffs pin, since bpf_obj_do_get() gates only on path_permission() and bpf_map_mmap() performs no capability check. Arena map creation itself is reachable by an unprivileged user in a user namespace through a delegated BPF token (bpf_token_capable() uses ns_capable() against token-\u003euserns), which is the intended container delegation model shipped in the same release.\nUI:N - The attacking process performs every step itself \u2014 create/obtain the map fd, mmap, then fork or mremap and exit. No action by any other user or victim process is required.\nS:U - The corruption is confined to kernel slab memory and the BPF arena\u0027s own bookkeeping, all within the kernel\u0027s security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling vma_list pointer is dereferenced after being freed from the kmalloc-32 cache, so an attacker who reclaims the object with a heap spray gets the kernel reading and acting on attacker-shaped data, and the unlink write can be aimed to disclose arbitrary kernel memory. The corrupted arena-\u003evma_list also breaks the liveness check in arena_map_free(), extending the exposure to arena-backed pages.\nI:H - The second arena_vm_close() performs list_del() on freed, attacker-reclaimable memory, giving the classic unlink write-what-where primitive with both the prev and next pointers under attacker control, and then kfree()s the object a second time. Combined, this yields arbitrary kernel memory write and a controlled double free, i.e. a realistic path to privilege escalation.\nA:H - Even without any exploitation attempt, the double free and use-after-free reliably produce slab corruption, list poison dereferences, and kernel panics (immediately so with KASAN, CONFIG_DEBUG_LIST, or CONFIG_LIST_HARDENED). An unprivileged local user can repeat this at will to crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:31.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf"
        }
      ],
      "title": "bpf: Fix remap of arena.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42075",
    "datePublished": "2024-07-29T15:52:38.154Z",
    "dateReserved": "2024-07-29T15:50:41.169Z",
    "dateUpdated": "2026-08-05T11:35:31.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42075",
      "date": "2026-08-15",
      "epss": "0.00221",
      "percentile": "0.12914"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.9\", \"matchCriteriaId\": \"18FE1EAE-C36C-49FC-A5E0-0A661CDC561E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9.1\", \"versionEndExcluding\": \"6.9.8\", \"matchCriteriaId\": \"1557DCF8-46D3-4910-8B19-5C77412AB681\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix remap of arena.\\n\\nThe bpf arena logic didn\u0027t account for mremap operation. Add a refcnt for\\nmultiple mmap events to prevent use-after-free in arena_vm_close.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bpf: Se corrigi\\u00f3 la reasignaci\\u00f3n de arena. La l\\u00f3gica de bpf arena no tuvo en cuenta la operaci\\u00f3n de mremap. Agregue un refcnt para m\\u00faltiples eventos mmap para evitar el uso despu\\u00e9s de la liberaci\\u00f3n en arena_vm_close.\"}]",
      "id": "CVE-2024-42075",
      "lastModified": "2024-11-21T09:33:32.477",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-29T16:15:06.900",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:49:40.000Z",
      "cve": "CVE-2024-42075",
      "id": "msrc_CVE-2024-42075",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix remap of arena.",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-42075.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42075\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T16:15:06.900\",\"lastModified\":\"2026-08-04T11:19:31.980\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix remap of arena.\\n\\nThe bpf arena logic didn\u0027t account for mremap operation. Add a refcnt for\\nmultiple mmap events to prevent use-after-free in arena_vm_close.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bpf: Se corrigi\u00f3 la reasignaci\u00f3n de arena. La l\u00f3gica de bpf arena no tuvo en cuenta la operaci\u00f3n de mremap. Agregue un refcnt para m\u00faltiples eventos mmap para evitar el uso despu\u00e9s de la liberaci\u00f3n en arena_vm_close.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/arena.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"317460317a02a1af512697e6e964298dedd8a163\",\"lessThan\":\"87496a1b01e8e2e399428c0db25e106f7961d01e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"317460317a02a1af512697e6e964298dedd8a163\",\"lessThan\":\"b90d77e5fd784ada62ddd714d15ee2400c28e1cf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/arena.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.8\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:19:30.060305Z\",\"id\":\"CVE-2024-42075\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.9\",\"matchCriteriaId\":\"18FE1EAE-C36C-49FC-A5E0-0A661CDC561E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.1\",\"versionEndExcluding\":\"6.9.8\",\"matchCriteriaId\":\"1557DCF8-46D3-4910-8B19-5C77412AB681\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:42:40+00:00",
      "cve": "CVE-2024-42075",
      "id": "CVE-2024-42075",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix remap of arena.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42075.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:02:43Z",
      "cve": "CVE-2024-42075",
      "id": "CVE-2024-42075",
      "initial_release_date": "2024-08-06T02:00:22Z",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42075",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42075.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:32.802Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42075\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:19:30.060305Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.854Z\"}}], \"cna\": {\"title\": \"bpf: Fix remap of arena.\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"317460317a02a1af512697e6e964298dedd8a163\", \"lessThan\": \"87496a1b01e8e2e399428c0db25e106f7961d01e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"317460317a02a1af512697e6e964298dedd8a163\", \"lessThan\": \"b90d77e5fd784ada62ddd714d15ee2400c28e1cf\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/arena.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/arena.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/87496a1b01e8e2e399428c0db25e106f7961d01e\"}, {\"url\": \"https://git.kernel.org/stable/c/b90d77e5fd784ada62ddd714d15ee2400c28e1cf\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix remap of arena.\\n\\nThe bpf arena logic didn\u0027t account for mremap operation. Add a refcnt for\\nmultiple mmap events to prevent use-after-free in arena_vm_close.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.8\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:26:29.917Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42075\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:26:29.917Z\", \"dateReserved\": \"2024-07-29T15:50:41.169Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T15:52:38.154Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.