CVE-2024-42271

What it actually does

Use-after-free in net/iucv due to non-atomic compare-and-swap on iucv->path when iucv_sever_path is invoked concurrently from process context and BH/tasklet context, allowing iucv_sock_close to operate on a freed path after iucv_callback_connrej.

Why it matters to the business

Kernel panic and system instability on Linux hosts using AF_IUCV sockets, with potential for local privilege escalation; high downstream impact across 5646 dependents increases exposure for enterprise and cloud workloads.

How an attack unfolds

An attacker with local access triggers socket operations that race iucv_sock_close against iucv_tasklet_fn calling iucv_callback_connrej; the missing atomic protection lets the process-context path dereference a freed iucv_path structure, leading to panic or controlled memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 84f40b46787ecb67c7ad08a5bb1376141fa10c01 or later stable releases; rebuild and reboot affected systems; apply distribution backports where available.

How to confirm the fix worked

Verify the running kernel contains commit 84f40b46787ecb67c7ad08a5bb1376141fa10c01, reproduce socket close under load to confirm absence of the described panic, and monitor for the UAF call trace.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Create or manipulate an AF_IUCV socket
3. Induce concurrent close and connection-reject events to hit the race window
4. Trigger dereference of the freed path object causing UAF
5. Escalate via memory corruption or crash the kernel

How to detect it

Search kernel logs and crash dumps for call traces containing iucv_path_sever, iucv_sever_path, iucv_sock_close, and iucv_callback_connrej; monitor for task_work_run and system_call frames ending in kernel panic during socket release.

• iucv_path_sever+0x96/0x138
• iucv_sever_path+0xc2/0xd0 [af_iucv]
• iucv_sock_close+0xa6/0x310 [af_iucv]
• Kernel panic - not syncing: Fatal exception in interrupt
• Last Breaking-Event-Address: iucv_path_sever+0x90/0x138

What your security team should do

• Prioritize patching systems with AF_IUCV usage within the next 30 days given widespread kernel deployment
• Restrict local user access on systems exposing iucv sockets until patched
• Update kernel packages via distribution channels and schedule reboots
• Add kernel panic monitoring for iucv_path_sever traces to detect exploitation attempts