PT-2024-29820 · Linux+7 · Linux Kernel+7
Published
2024-07-31
·
Updated
2025-09-29
·
CVE-2024-42268
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
The vulnerability is related to a missing lock on sync reset reload in the net/mlx5 component of the Linux kernel. When a remote host updates devlink on reload actions performed on that host, it misses taking the devlink lock before calling
devlink remote reload actions performed(), resulting in a lock assert. This issue can be triggered when the devlink notify function is called, and it may lead to a denial of service.Recommendations
To resolve this issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider disabling the
devlink remote reload actions performed() function until a patch is available. Restrict access to the devlink notify function to minimize the risk of exploitation. Avoid using the devlink module in the affected API endpoints until the issue is resolved.Exploit
Fix
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu