What is CVE-2024-39474?

CVE-2024-39474 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 5.17 onward and patched in 6.1.95, 6.6.34, 6.9.5 and others. CVE-2024-39474 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-39474?

CVE-2024-39474 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2024-39474?

Yes, CVE-2024-39474 has been patched. Fixed versions include 6.1.95, 6.6.34, 6.9.5 and others. If you are running Linux kernel 5.17 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-39474 actively exploited?

CVE-2024-39474 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2024-39474

Medium

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows: process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --> oom-killer send SIGKILL to process-a if (fatal_signal_pending(current)) break; --> return NULL; To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set. This issue occurred during OPLUS KASAN TEST. Below is part of the log -> oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); kernel panic by NULL pointer dereference. erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c

Package Linux Kernel

Published 2024-07-05

Last modified 2025-11-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-770

CVE-2024-39474 is classified as CWE-770

See CWE-770 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 5.17 and later are affected. Fixed in 6.1.95, 6.6.34, 6.9.5, 6.10 and their respective stable series.

Affected from

≥ 5.17

Fixed in

✓ 6.1.95 6.1.x ✓ 6.6.34 6.6.x ✓ 6.9.5 6.9.x ✓ 6.10

References

5 total

Kernel Git
https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91

Mailing List Patch
Kernel Git
https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4

Mailing List Patch
Kernel Git
https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc

Mailing List Patch
Kernel Git
https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da

Mailing List Patch
Debian Security
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Details

CVE ID CVE-2024-39474

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-07-05

Modified 2025-11-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-39474?

CVE-2024-39474 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.17 onward and has been patched in 6.1.95, 6.6.34, 6.9.5 and others. CVE-2024-39474 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-39474?

CVE-2024-39474 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2024-39474?

Yes. CVE-2024-39474 has been patched. Fixed versions include 6.1.95, 6.6.34, 6.9.5 and others. If you are running Linux kernel 5.17 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-39474 actively exploited?

No. CVE-2024-39474 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.