{"id":"DEBIAN-CVE-2024-42271","details":"In the Linux kernel, the following vulnerability has been resolved:  net/iucv: fix use after free in iucv_sock_close()  iucv_sever_path() is called from process context and from bh context. iucv-\u003epath is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with atomic compare and swap, otherwise there is a small window where iucv_sock_close() will try to work with a path that has already been severed and freed by iucv_callback_connrej() called by iucv_tasklet_fn().  Example: [452744.123844] Call Trace: [452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880) [452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138 [452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8 [452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48 [452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268 [452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0 [452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90 [452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8 [452744.125319] Last Breaking-Event-Address: [452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138 [452744.125324] [452744.125325] Kernel panic - not syncing: Fatal exception in interrupt  Note that bh_lock_sock() is not serializing the tasklet context against process context, because the check for sock_owned_by_user() and corresponding handling is missing.  Ideas for a future clean-up patch: A) Correct usage of bh_lock_sock() in tasklet context, as described in Re-enqueue, if needed. This may require adding return values to the tasklet functions and thus changes to all users of iucv.  B) Change iucv tasklet into worker and use only lock_sock() in af_iucv.","modified":"2026-09-15T09:03:10.378175940Z","published":"2024-08-17T09:15:08.307Z","upstream":["CVE-2024-42271"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-42271"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.106-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42271.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42271.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42271.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}