GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-42254 (GCVE-0-2024-42254)

Vulnerability from cvelistv5 – Published: 2024-08-08 08:49 – Updated: 2026-05-11 20:28
VLAI
Title
io_uring: fix error pbuf checking
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Call Trace: <TASK> io_put_bl io_uring/kbuf.c:378 [inline] io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:13 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 46b1b3d81a7e99574e1a2f914086bc2fe382d79d , < 78aefac7efdffddf7889405b7c08e6e0f030fa35 (git)
Affected: 87585b05757dc70545efb434669708d276125559 , < 68d19af95a353f5e2b021602180b65b303eba99d (git)
Affected: 87585b05757dc70545efb434669708d276125559 , < bcc87d978b834c298bbdd9c52454c5d0a946e97e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.1 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42254",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:06.431767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:05.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78aefac7efdffddf7889405b7c08e6e0f030fa35",
              "status": "affected",
              "version": "46b1b3d81a7e99574e1a2f914086bc2fe382d79d",
              "versionType": "git"
            },
            {
              "lessThan": "68d19af95a353f5e2b021602180b65b303eba99d",
              "status": "affected",
              "version": "87585b05757dc70545efb434669708d276125559",
              "versionType": "git"
            },
            {
              "lessThan": "bcc87d978b834c298bbdd9c52454c5d0a946e97e",
              "status": "affected",
              "version": "87585b05757dc70545efb434669708d276125559",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix error pbuf checking\n\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\nerror handling in io_alloc_pbuf_ring().\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\nCall Trace:\n \u003cTASK\u003e\n io_put_bl io_uring/kbuf.c:378 [inline]\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\n process_one_work kernel/workqueue.c:3231 [inline]\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:28:47.215Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78aefac7efdffddf7889405b7c08e6e0f030fa35"
        },
        {
          "url": "https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e"
        }
      ],
      "title": "io_uring: fix error pbuf checking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42254",
    "datePublished": "2024-08-08T08:49:14.289Z",
    "dateReserved": "2024-07-30T07:40:12.257Z",
    "dateUpdated": "2026-05-11T20:28:47.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42254",
      "date": "2026-09-15",
      "epss": "0.0021",
      "percentile": "0.11312"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EA80796-744E-45F5-8632-2AB4F7889FCD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"BD973AA4-A789-49BD-8D57-B2846935D3C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: fix error pbuf checking\\n\\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\\nerror handling in io_alloc_pbuf_ring().\\n\\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\\nCall Trace:\\n \u003cTASK\u003e\\n io_put_bl io_uring/kbuf.c:378 [inline]\\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\\n process_one_work kernel/workqueue.c:3231 [inline]\\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\\n kthread+0x2f0/0x390 kernel/kthread.c:389\\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: io_uring: corrige el error pbuf comprobando Syz informa un problema, que se reduce a un manejo inconsistente de errores NULL vs IS_ERR en io_alloc_pbuf_ring(). KASAN: null-ptr-deref en el rango [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Seguimiento de llamadas:  io_put_bl io_uring/kbuf.c:378 l\\u00ednea] io_destroy_buffers+0x14e /0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 Process_one_work kernel/workqueue.c:3231 [en l\\u00ednea] N\\u00facleo 0xa2c/0x1830 /workqueue.c:3312 trabajador_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/ 0x30 arco/x86/entrada/entry_64.S:244\"}]",
      "id": "CVE-2024-42254",
      "lastModified": "2024-09-06T13:40:04.737",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-08T09:15:08.290",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42254\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-08T09:15:08.290\",\"lastModified\":\"2026-06-17T07:49:06.830\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: fix error pbuf checking\\n\\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\\nerror handling in io_alloc_pbuf_ring().\\n\\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\\nCall Trace:\\n \u003cTASK\u003e\\n io_put_bl io_uring/kbuf.c:378 [inline]\\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\\n process_one_work kernel/workqueue.c:3231 [inline]\\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\\n kthread+0x2f0/0x390 kernel/kthread.c:389\\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: io_uring: corrige el error pbuf comprobando Syz informa un problema, que se reduce a un manejo inconsistente de errores NULL vs IS_ERR en io_alloc_pbuf_ring(). KASAN: null-ptr-deref en el rango [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Seguimiento de llamadas:  io_put_bl io_uring/kbuf.c:378 l\u00ednea] io_destroy_buffers+0x14e /0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 Process_one_work kernel/workqueue.c:3231 [en l\u00ednea] N\u00facleo 0xa2c/0x1830 /workqueue.c:3312 trabajador_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/ 0x30 arco/x86/entrada/entry_64.S:244\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"io_uring/kbuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"46b1b3d81a7e99574e1a2f914086bc2fe382d79d\",\"lessThan\":\"78aefac7efdffddf7889405b7c08e6e0f030fa35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87585b05757dc70545efb434669708d276125559\",\"lessThan\":\"68d19af95a353f5e2b021602180b65b303eba99d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87585b05757dc70545efb434669708d276125559\",\"lessThan\":\"bcc87d978b834c298bbdd9c52454c5d0a946e97e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"io_uring/kbuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.1\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:13:06.431767Z\",\"id\":\"CVE-2024-42254\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EA80796-744E-45F5-8632-2AB4F7889FCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78aefac7efdffddf7889405b7c08e6e0f030fa35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:39:01+00:00",
      "cve": "CVE-2024-42254",
      "id": "CVE-2024-42254",
      "initial_release_date": "2024-08-08T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io_uring: fix error pbuf checking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42254.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T14:01:00Z",
      "cve": "CVE-2024-42254",
      "id": "CVE-2024-42254",
      "initial_release_date": "2024-08-09T01:40:01Z",
      "product_status:known_not_affected": "371",
      "product_status:recommended": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42254",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42254.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42254\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:13:06.431767Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.472Z\"}}], \"cna\": {\"title\": \"io_uring: fix error pbuf checking\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"46b1b3d81a7e99574e1a2f914086bc2fe382d79d\", \"lessThan\": \"78aefac7efdffddf7889405b7c08e6e0f030fa35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87585b05757dc70545efb434669708d276125559\", \"lessThan\": \"68d19af95a353f5e2b021602180b65b303eba99d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"87585b05757dc70545efb434669708d276125559\", \"lessThan\": \"bcc87d978b834c298bbdd9c52454c5d0a946e97e\", \"versionType\": \"git\"}], \"programFiles\": [\"io_uring/kbuf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"io_uring/kbuf.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78aefac7efdffddf7889405b7c08e6e0f030fa35\"}, {\"url\": \"https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d\"}, {\"url\": \"https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring: fix error pbuf checking\\n\\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\\nerror handling in io_alloc_pbuf_ring().\\n\\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\\nCall Trace:\\n \u003cTASK\u003e\\n io_put_bl io_uring/kbuf.c:378 [inline]\\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\\n process_one_work kernel/workqueue.c:3231 [inline]\\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\\n kthread+0x2f0/0x390 kernel/kthread.c:389\\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.1\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:28:47.215Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42254\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:28:47.215Z\", \"dateReserved\": \"2024-07-30T07:40:12.257Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-08T08:49:14.289Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.