CVE-2024-42254

What it actually does

Inconsistent NULL vs IS_ERR error handling in io_alloc_pbuf_ring allows a null pointer to reach __io_remove_buffers during buffer cleanup on io_uring ring destruction, causing a kernel null-ptr-deref.

Why it matters to the business

Systems using io_uring for high-performance I/O may experience kernel crashes leading to denial of service and unplanned downtime; urgency remains low given absent KEV status and flat EPSS trend.

How an attack unfolds

An attacker crafts io_uring submissions that force io_alloc_pbuf_ring to return an error pointer treated as NULL; subsequent io_ring_ctx_free path calls io_destroy_buffers which dereferences the invalid pointer during kbuf cleanup.

How to fix it

Upgrade Linux kernel to 6.10.1 or apply commit 78aefac7efdffddf7889405b7c08e6e0f030fa35; for AlmaLinux 8 update daxctl, ndctl and related packages to 71.1-3.el8.

How to confirm the fix worked

Confirm kernel version or presence of the fixing commit; reproduce with syzkaller and verify absence of KASAN null-ptr-deref in io_uring/kbuf.c.

Typical attack path

1. Setup io_uring instance and register buffers
2. Trigger allocation path that returns ERR_PTR instead of NULL
3. Initiate ring exit or destruction
4. Reach __io_remove_buffers with invalid pointer causing dereference

How to detect it

Search kernel logs and crash dumps for oops/panic messages containing __io_remove_buffers, io_uring/kbuf.c:341, or io_ring_ctx_free paths; correlate with process exit of io_uring users.

• __io_remove_buffers+0xac/0x700
• io_uring/kbuf.c:341
• io_put_bl io_uring/kbuf.c:378
• io_destroy_buffers+0x14e/0x490

What your security team should do

• Apply kernel updates to 6.10.1 or later on all hosts using io_uring
• Audit workloads for io_uring usage and prioritize servers first
• Monitor stable git trees for backports to older LTS branches