PT-2024-7371 · Linux+6 · Linux Kernel+6

Dohyun Kim

+1

·

Published

2024-07-10

·

Updated

2026-05-26

·

CVE-2024-42239

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The issue is related to the BPF timer functionality in the Linux kernel. When two or more timer callbacks are executed in parallel and attempt to cancel each other, it can lead to a deadlock situation. This happens because the bpf timer cancel function waits for the callback to finish executing, causing a lockup. To resolve this, an atomic counter named 'cancelling' is added to the bpf hrtimer to track outstanding cancellation requests. If there are any, the operation is failed with an error to prevent the deadlock.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

ALSA-2025_16880
ALT-PU-2024-13979
ALT-PU-2024-14046
AZL-47453
AZL-47604
BDU:2024-08738
CVE-2024-42239
ECHO-7625-746A-0E67
OESA-2024-2124
OPENSUSE-SU-2024_3190-1
OPENSUSE-SU-2024_3209-1
OPENSUSE-SU-2024_3483-1
SUSE-SU-2024:3190-1
SUSE-SU-2024:3194-1
SUSE-SU-2024:3195-1
SUSE-SU-2024:3209-1
SUSE-SU-2024:3383-1
SUSE-SU-2024:3483-1
SUSE-SU-2025:20044-1
SUSE-SU-2025:20047-1
USN-7089-1
USN-7089-2
USN-7089-3
USN-7089-4
USN-7089-5
USN-7089-6
USN-7089-7
USN-7090-1
USN-7095-1
USN-7156-1

Affected Products

Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu