{"id":"CVE-2024-42254","state":"PUBLISHED","title":"io_uring: fix error pbuf checking","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix error pbuf checking\n\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\nerror handling in io_alloc_pbuf_ring().\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\nCall Trace:\n <TASK>\n io_put_bl io_uring/kbuf.c:378 [inline]\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\n process_one_work kernel/workqueue.c:3231 [inline]\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244","publishedAt":"2024-08-08T08:49:14.289Z","updatedAt":"2026-05-11T20:28:47.215Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46b1b3d81a7e99574e1a2f914086bc2fe382d79d","status":"affected","lessThan":"78aefac7efdffddf7889405b7c08e6e0f030fa35","versionType":"git"},{"version":"87585b05757dc70545efb434669708d276125559","status":"affected","lessThan":"68d19af95a353f5e2b021602180b65b303eba99d","versionType":"git"},{"version":"87585b05757dc70545efb434669708d276125559","status":"affected","lessThan":"bcc87d978b834c298bbdd9c52454c5d0a946e97e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/kbuf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.10.1","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/kbuf.c"]}],"references":["https://git.kernel.org/stable/c/78aefac7efdffddf7889405b7c08e6e0f030fa35","https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d","https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/42xxx/CVE-2024-42254.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42254","state":"PUBLISHED","datePublished":"2024-08-08T08:49:14.289Z","dateUpdated":"2026-05-11T20:28:47.215Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-30T07:40:12.257Z"},"containers":{"cna":{"title":"io_uring: fix error pbuf checking","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix error pbuf checking\n\nSyz reports a problem, which boils down to NULL vs IS_ERR inconsistent\nerror handling in io_alloc_pbuf_ring().\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341\nCall Trace:\n <TASK>\n io_put_bl io_uring/kbuf.c:378 [inline]\n io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392\n io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613\n io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844\n process_one_work kernel/workqueue.c:3231 [inline]\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46b1b3d81a7e99574e1a2f914086bc2fe382d79d","status":"affected","lessThan":"78aefac7efdffddf7889405b7c08e6e0f030fa35","versionType":"git"},{"version":"87585b05757dc70545efb434669708d276125559","status":"affected","lessThan":"68d19af95a353f5e2b021602180b65b303eba99d","versionType":"git"},{"version":"87585b05757dc70545efb434669708d276125559","status":"affected","lessThan":"bcc87d978b834c298bbdd9c52454c5d0a946e97e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/kbuf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.10.1","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/kbuf.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/78aefac7efdffddf7889405b7c08e6e0f030fa35"},{"url":"https://git.kernel.org/stable/c/68d19af95a353f5e2b021602180b65b303eba99d"},{"url":"https://git.kernel.org/stable/c/bcc87d978b834c298bbdd9c52454c5d0a946e97e"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T20:28:47.215Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.10.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.11"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42254","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:13:06.431767Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:05.301Z"}}]}}}