PT-2024-9053 · Linux+9 · Linux Kernel+9
Syzbot
·
Published
2024-05-05
·
Updated
2026-03-14
·
CVE-2024-38580
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to the epoll component in the Linux kernel, where a file pointer may race with the last 'fput()' call, causing the file reference count to go down to zero. This results in the file pointer being dead, and any use of it won't actually get a reference to the file. The problem occurs when epoll calls out to vfs poll() with a file pointer that may be torn down due to a racing condition. To fix this, a valid reference on the file pointer is ensured before calling down to vfs poll() from the epoll routines.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu