PT-2024-29804 · Linux · Linux Kernel

David Lechner · Published 2024-07-08 · Updated 2024-08-09 · CVE-2024-42249

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises from the incorrect call to spi maybe unoptimize message() in spi async(), which can corrupt the message while it is being used by the controller driver. This is because the message is likely to be in the queue and not transferred yet. The function spi maybe unoptimize message() is already called in the correct place in spi finalize current message() to balance the call to spi maybe optimize message() in spi async().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-99

Related Identifiers

BDU:2025-16205

CVE-2024-42249

Affected Products

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42249.json · Exploit
• https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16205 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-42249 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-42249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42249 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-42249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42249 · Vendor Advisory
• https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42249 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42249 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.10 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://docs.bell-sw.com/security/cves/CVE-2024-42249 · Note