LiveActive security incident?Get immediate response
CVE Record

CVE-2024-42135: vhost_task: Handle SIGKILL by flushing work and exiting

In the Linux kernel, the following vulnerability has been resolved: vhost_task: Handle SIGKILL by flushing work and exiting Instead of lingering until the device is closed, this has us handle SIGKILL by: 1. marking the worker as killed so we no longer try to use it with new virtqueues and new flush operations. 2. setting the virtqueue to worker mapping so no new works are queued. 3. running all the exiting works.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-42135 is a Linux kernel issue in vhost worker handling. When a vhost worker receives SIGKILL, it could linger until the device is closed. The kernel fix makes the worker stop taking new work, detach virtqueue mappings, flush existing work, and exit cleanly.

Executive priority

Track and patch through normal kernel maintenance, prioritizing virtualization infrastructure. Urgency cannot be rated higher from the provided evidence because impact severity and exploitation evidence are not documented.

Technical view

The issue is in vhost_task SIGKILL handling for Linux vhost/virtqueue work processing. The resolved behavior marks the worker killed, prevents new virtqueues or flushes from using it, clears virtqueue-to-worker mapping, and runs queued exiting work. The sources do not provide CVSS, CWE, or a complete impact statement.

Likely exposure

Exposure is most relevant to Linux systems using vhost-based virtualization or virtqueue-backed devices on affected kernel versions. Distribution backports may change apparent version exposure, so vulnerability managers should rely on vendor kernel advisories and package metadata.

Exploitation context

The provided sources do not show active exploitation, public exploit availability, or CISA KEV listing. Treat this as a kernel reliability and virtualization-component risk until vendor advisories clarify practical impact.

Researcher notes

The source record describes a resolved lifecycle bug, not an exploit primitive. Key research questions are impact, triggerability from guest or local contexts, and whether lingering workers can cause denial of service or unsafe state reuse.

Mitigation direction

  • Apply vendor-supported kernel updates containing the referenced stable fixes.
  • Prioritize virtualization hosts and systems using vhost or virtqueue devices.
  • Check distribution advisories for backported fixes and exact package versions.
  • Avoid unsupported manual kernel changes unless part of your standard engineering process.

Validation and detection

  • Inventory Linux kernel versions across virtualization hosts and guests.
  • Confirm whether systems use vhost-backed devices or related virtualization features.
  • Map installed kernels to vendor advisories or referenced stable commits.
  • Verify updated kernels are installed and active after maintenance windows.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-42135 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf9010dbdce911ee1f1af1398a24b1f9f992e0080, f9010dbdce911ee1f1af1398a24b1f9f992e0080, f9010dbdce911ee1f1af1398a24b1f9f992e0080unaffected
LinuxLinux6.4, 0, 6.6.39, 6.9.9, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.