PT-2024-5431 · Linux+6 · Linux Kernel+6
Jann Horn
·
Published
2024-06-28
·
Updated
2025-09-29
·
CVE-2024-39486
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a race condition in the
drm file update pid() function, which can lead to a use-after-free of a struct pid. This occurs when the filp->pid pointer is stored in the file and the reference count of the struct pid is incremented after dropping the dev->filelist mutex. The race condition can only happen when CONFIG PREEMPT RCU=y is set, as it requires the RCU to detect a quiescent state in code that is not explicitly calling into the scheduler. The fix involves ensuring that an extra reference to the pid is taken before storing the pointer to the current task's pid in the file.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu