Security readout for executives and security teams
Plain-English summary
A race in the Linux kernel’s IUCV socket shutdown handling can access an already-freed path object. The supplied trace shows this causing a kernel panic. CVSS 3.1 rates potential confidentiality, integrity, and availability impacts as high, but exploitation requires local, low-privileged access and no user interaction.
Executive priority
Prioritize affected multi-user or otherwise locally accessible systems because successful triggering occurs in kernel context and may crash the host. Apply normal high-severity kernel patching urgency, accelerated for systems using IUCV. Avoid emergency internet-edge treatment unless separate evidence shows remote reachability or exploitation.
Technical view
Process-context socket closure can race with a bottom-half tasklet rejecting a connection. Both may attempt to sever the same IUCV path because path ownership was not claimed atomically. The callback can sever and free the path before iucv_sock_close() uses it, producing a use-after-free. Stable-kernel commits implement the correction.
Likely exposure
Exposure is most likely on Linux systems running an affected kernel where AF_IUCV functionality is present and reachable by a local low-privileged user. The supplied version data is not sufficiently clear to determine every fixed release reliably. This is a local-attack issue, not evidence of direct internet exposure.
Exploitation context
The supplied CVSS vector is local, low complexity, low privileges, and requires no user interaction. A kernel panic is documented. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public weaponization, or a demonstrated path beyond the reported use-after-free.
Researcher notes
The core defect is a race over iucv->path between process and tasklet contexts; bh_lock_sock() did not provide the expected serialization. Atomic compare-and-swap is identified as necessary. The source discusses broader locking or worker redesign only as future cleanup, not as required remediation. Exact affected-to-fixed release mapping remains unclear from the bundle.
Mitigation direction
- Update to a vendor-supported kernel release containing the applicable stable fix.
- Check Linux distribution advisories to map the fix to packaged kernel versions.
- Restrict unnecessary local access while patching is pending.
- Review whether AF_IUCV functionality is required on affected systems.
Validation and detection
- Record each system’s running kernel version and distribution package revision.
- Compare package revisions with vendor advisories and the referenced stable commits.
- Confirm whether AF_IUCV is present or used in the deployed configuration.
- After updating, verify the fixed kernel is running following reboot.
- Monitor kernel logs for IUCV faults, use-after-free reports, or unexpected panics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42271 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01CVE reference, Linux
- https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0CVE reference, Linux
- https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895CVE reference, Linux
- https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5CVE reference, Linux
- https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876CVE reference, Linux
- https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84CVE reference, Linux
- https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407dCVE reference, Linux
- https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.