CVE-2024-42069

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42069", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.168Z", "datePublished": "2024-07-29T15:52:33.273Z", "dateUpdated": "2026-08-05T11:35:28.180Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:28.180Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `add_adev()` is reached only through the MANA PCI probe/resume paths (`mana_gd_probe()`/`mana_gd_resume()` \u2192 `mana_probe()`), driven by local device binding, PCI hot-add and power-management events. No remotely received network data reaches this code, and the failing `auxiliary_device_add()` name/id are kernel-generated, so even a malicious device cannot steer it.\nAC:L - The only precondition is an allocation failure inside `dev_set_name()`/`device_add()`, which a local attacker can induce by driving the system into memory pressure while repeatedly cycling the probe path until the window is hit. Nothing in the path depends on state outside the attacker's influence, and the attempt can be retried indefinitely.\nPR:L - The triggering condition \u2014 memory exhaustion making `GFP_KERNEL` allocations fail \u2014 is fully inducible by an ordinary unprivileged local user, and MANA probe events also occur unprivileged in Azure guests (boot, host-initiated VF hot-add/revoke during servicing and live migration). This matches the scoring of CVE-2026-43056, the sibling defect in the identical error path of this same function.\nUI:N - The entire sequence runs inside kernel probe/resume context with no human action required \u2014 no mount, file open, or click. Probe is driven by the PCI/driver core and by host-initiated hotplug.\nS:U - The double free and use-after-free corrupt kernel slab objects within the same security authority as the vulnerable driver. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `mana_adev_idx_free(adev->id)` reads `adev->id` out of memory already released by `adev_release()`, and the subsequent double free creates a SLUB freelist cycle that hands the same `kmalloc-1k`/`kmalloc-2k` object to two independent allocations. Because that is a general-purpose cache shared with attacker-sprayable objects, the resulting type confusion is leverageable into a kernel memory disclosure primitive.\nI:H - A double free giving two owners of one slab object is the classic dup-alloc primitive: the attacker reclaims the chunk with a groomed structure while the driver still writes through the stale `struct device`/`auxiliary_device` fields, yielding arbitrary write and function-pointer hijack. The stale `adev->id` is additionally fed into `ida_free()`, corrupting global IDA allocator state.\nA:H - On kernels with `CONFIG_SLAB_FREELIST_HARDENED`, the immediate re-free trips `set_freepointer()`'s `BUG_ON(object == fp)` for a hard kernel panic; without it, the poisoned freelist causes an oops or arbitrary corruption shortly after. Either outcome takes down the machine and can be re-triggered on every probe cycle."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "versions": [{"version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "3243e64eb4d897c3eeb48b2a7221ab5a95e1282a", "status": "affected", "versionType": "git"}, {"version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "ed45c0a0b662079d4c0e518014cc148c753979b4", "status": "affected", "versionType": "git"}, {"version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "1864b8224195d0e43ddb92a8151f54f6562090cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.37", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.8", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.9.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"}, {"url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"}, {"url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"}], "title": "net: mana: Fix possible double free in error handling path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:30:29.384Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42069", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:19:49.454221Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:08.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:30:29.384Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42069", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:19:49.454221Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.719Z"}}], "cna": {"title": "net: mana: Fix possible double free in error handling path", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "3243e64eb4d897c3eeb48b2a7221ab5a95e1282a", "versionType": "git"}, {"status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "ed45c0a0b662079d4c0e518014cc148c753979b4", "versionType": "git"}, {"status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "lessThan": "1864b8224195d0e43ddb92a8151f54f6562090cc", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.37", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.8", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"}, {"url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"}, {"url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.37", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.8", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:26:22.756Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42069", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:26:22.756Z", "dateReserved": "2024-07-29T15:50:41.168Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-29T15:52:33.273Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3243e64eb4d897c3eeb48b2a7221ab5a95e1282a", "status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "versionType": "git"}, {"lessThan": "ed45c0a0b662079d4c0e518014cc148c753979b4", "status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "versionType": "git"}, {"lessThan": "1864b8224195d0e43ddb92a8151f54f6562090cc", "status": "affected", "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microsoft/mana/mana_en.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.37", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "108695B6-7133-4B6C-80AF-0F66880FE858", "versionEndExcluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F039BDA1-E26D-4651-9C4F-F13860449857", "versionEndExcluding": "6.6.37", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E95105F2-32E3-4C5F-9D18-7AEFD0E6275C", "versionEndExcluding": "6.9.8", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mana: corrige posible double free en la ruta de manejo de errores Cuando auxiliar_device_add() devuelve un error y luego llama a auxiliar_device_uninit(), la funci\u00f3n de devoluci\u00f3n de llamada adev_release llama a kfree(madev). No deber\u00edamos volver a llamar a kfree(madev) en la ruta de manejo de errores. Establezca 'madev' en NULL."}], "id": "CVE-2024-42069", "lastModified": "2026-08-04T11:19:31.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42069", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:19:49.454221Z", "version": "2.0.3"}}]}, "published": "2024-07-29T16:15:06.467", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: mana: Fix possible double free in error handling path", "id": "2300507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300507"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-415", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: mana: Fix possible double free in error handling path\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL."], "name": "CVE-2024-42069", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42069\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42069\nhttps://lore.kernel.org/linux-cve-announce/2024072952-CVE-2024-42069-a6b7@gregkh/T"], "threat_severity": "Moderate"}

{}