What is CVE-2024-42104?

CVE-2024-42104 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 2.6.30 onward and patched in 4.19.318, 5.4.280, 5.10.222 and others. CVE-2024-42104 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-42104?

CVE-2024-42104 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2024-42104?

Yes, CVE-2024-42104 has been patched. Fixed versions include 4.19.318, 5.4.280, 5.10.222 and others. If you are running Linux kernel 2.6.30 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-42104 actively exploited?

CVE-2024-42104 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2024-42104

High

In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for inode numbers on directory entries Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case). The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking. Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages. Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis.

Package Linux Kernel

Published 2024-07-30

Last modified 2025-11-03

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2024-42104 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.30 and later are affected. Fixed in 4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9, 6.10 and their respective stable series.

Affected from

≥ 2.6.30

Fixed in

✓ 4.19.318 4.19.x ✓ 5.4.280 5.4.x ✓ 5.10.222 5.10.x ✓ 5.15.163 5.15.x ✓ 6.1.98 6.1.x ✓ 6.6.39 6.6.x ✓ 6.9.9 6.9.x ✓ 6.10

References

9 total

Kernel Git
https://git.kernel.org/stable/c/07c176e7acc5579c133bb923ab21316d192d0a95

Patch
Kernel Git
https://git.kernel.org/stable/c/1b7d549ed2c1fa202c751b69423a0d3a6bd5a180

Patch
Kernel Git
https://git.kernel.org/stable/c/265fff1a01cdc083aeaf0d934c929db5cc64aebf

Patch
Kernel Git
https://git.kernel.org/stable/c/2f2fa9cf7c3537958a82fbe8c8595a5eb0861ad7

Patch
Kernel Git
https://git.kernel.org/stable/c/3ab40870edb883b9633dc5cd55f5a2a11afa618d

Patch

Showing 5 of 9 references View all on NVD

Details

CVE ID CVE-2024-42104

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2024-07-30

Modified 2025-11-03

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-42104?

CVE-2024-42104 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 2.6.30 onward and has been patched in 4.19.318, 5.4.280, 5.10.222 and others. CVE-2024-42104 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-42104?

CVE-2024-42104 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2024-42104?

Yes. CVE-2024-42104 has been patched. Fixed versions include 4.19.318, 5.4.280, 5.10.222 and others. If you are running Linux kernel 2.6.30 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-42104 actively exploited?

No. CVE-2024-42104 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.