CVE-2024-42285

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

State: Published
Severity: 9.8 Critical
Published: Aug 17, 2024
Updated: Aug 5, 2026
Reserved: Jul 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows:

conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler;

rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before d91d253c87fd1efece521ff2612078a35af673c6Affected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 7f25f296fc9bd0435be14e89bf657cd615a23574Affected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 94ee7ff99b87435ec63211f632918dc7f44dac79Affected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 557d035fe88d78dd51664f4dc0e1896c04c97cf6Affected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before dc8074b8901caabb97c2d353abd6b4e7fa5a59a5Affected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before ff5bbbdee08287d75d72e65b72a2b76d9637892aAffected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before ee39384ee787e86e9db4efb843818ef0ea9cb8aeAffected 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before aee2424246f9f1dadc33faa78990c1e2eb7826e4Affected
LinuxLinux	4.8Affected before 4.8Not affected 4.19.320 through 4.19.Not affected 5.4.282 through 5.4.Not affected 5.10.224 through 5.10.Not affected 5.15.165 through 5.15.Not affected 6.1.103 through 6.1.Not affected 6.6.44 through 6.6.Not affected 6.10.3 through 6.10.*Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before d91d253c87fd1efece521ff2612078a35af673c6Affected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 7f25f296fc9bd0435be14e89bf657cd615a23574Affected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 94ee7ff99b87435ec63211f632918dc7f44dac79Affected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before 557d035fe88d78dd51664f4dc0e1896c04c97cf6Affected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before dc8074b8901caabb97c2d353abd6b4e7fa5a59a5Affected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before ff5bbbdee08287d75d72e65b72a2b76d9637892aAffected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before ee39384ee787e86e9db4efb843818ef0ea9cb8aeAffected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to before aee2424246f9f1dadc33faa78990c1e2eb7826e4Affected

LinuxLinux

4.8Affected
before 4.8Not affected
4.19.320 through 4.19.*Not affected
5.4.282 through 5.4.*Not affected
5.10.224 through 5.10.*Not affected
5.15.165 through 5.15.*Not affected
6.1.103 through 6.1.*Not affected
6.6.44 through 6.6.*Not affected
6.10.3 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.