CVE-2024-42271

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50

Description The vulnerability is related to a use-after-free issue in the iucv sock close() function. The iucv sever path() function is called from both process context and bh context, and iucv->path is used as an indicator of whether someone else is taking care of severing the path. This needs to be done with atomic compare and swap to prevent a small window where iucv sock close() tries to work with a path that has already been severed and freed. The issue can lead to a kernel panic and potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider disabling the iucv sever path() function until a patch is available. Additionally, restricting access to the af iucv module can help minimize the risk of exploitation.