CVE-2024-42157: Linux vulnerability

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects IBM s390 protected-key handling. If a copy back to user space failed, sensitive data could remain on the kernel stack instead of being wiped. The sources do not provide a CVSS score, confirmed exploitability, or broad impact details.

Executive priority

Treat this as a targeted kernel hygiene issue rather than an internet-scale emergency. Prioritize patching where s390 Linux systems handle sensitive cryptographic material, especially regulated or high-trust environments.

Technical view

CVE-2024-42157 is an s390/pkey cleanup flaw fixed by wiping sensitive stack data even when copy_to_user() fails. The affected scope is Linux kernel s390 protected key code across listed kernel lines. Public references are upstream stable commits and a Debian LTS advisory.

Likely exposure

Exposure appears limited to Linux systems on s390 architecture using the pkey protected-key functionality. General Linux hosts on other architectures are not indicated as affected in the provided sources.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation. The available description supports a sensitive-data-retention risk on an error path, but not a public exploit scenario.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit detail, or direct precondition analysis is included. The core signal is the upstream fix description: sensitive stack data needed wiping on the copy_to_user() failure path.

Mitigation direction

Apply vendor or distribution kernel updates that include the referenced stable fixes.
Prioritize s390 Linux systems using protected-key functionality.
Review Debian LTS guidance if running affected Debian kernel packages.
Check vendor advisories for backported fixes before assuming version strings are sufficient.

Validation and detection

Inventory Linux kernel versions on s390 systems.
Confirm whether pkey protected-key functionality is present or used.
Verify installed kernel changelogs reference CVE-2024-42157 or upstream fix commits.
After patching, confirm systems boot and cryptographic workloads function normally.

Prepared: May 19, 2026, 21:39 UTC (UTC+00:00)
Confidence: medium
Sources: 11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-42157 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jul 30, 2024, 07:46 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

10Source links

SSVC decision data

Timestamp: Sep 10, 2024, 16:15 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Jul 29, 2024, 15:50 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Jul 30, 2024, 07:46 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 20:28 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/6e2e374403bf73140d0efc9541cb1b3bea55ac02CVE reference, Linux
https://git.kernel.org/stable/c/b5eb9176ebd4697bc248bf8d145e66d782cf5250CVE reference, Linux
https://git.kernel.org/stable/c/93c034c4314bc4c4450a3869cd5da298502346adCVE reference, Linux
https://git.kernel.org/stable/c/4889f117755b2f18c23045a0f57977f3ec130581CVE reference, Linux
https://git.kernel.org/stable/c/c51795885c801b6b7e976717e0d6d45b1e5be0f0CVE reference, Linux
https://git.kernel.org/stable/c/90a01aefb84b09ccb6024d75d85bb8f620bd3487CVE reference, Linux
https://git.kernel.org/stable/c/c44a2151e5d21c66b070a056c26471f30719b575CVE reference, Linux
https://git.kernel.org/stable/c/1d8c270de5eb74245d72325d285894a577a945d9CVE reference, Linux
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinuxe80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7, e80d4af0a320972aac58e2004d0ba4e44ef4c5c7unaffected

LinuxLinux4.11, 0, 4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9, 6.10affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CVE-2024-42157: s390/pkey: Wipe sensitive data on failure