GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41096 (GCVE-0-2024-41096)

Vulnerability from cvelistv5 – Published: 2024-07-29 15:48 – Updated: 2026-08-05 11:35
VLAI
Title
PCI/MSI: Fix UAF in msi_capability_init
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128 allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ... Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ... That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path. Cure it by copying the descriptor and using the copy for the error exit path unmask operation. [ tglx: Massaged change log ]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:20 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bf6e054e0e3fbc9614355b760e18c8a14f952a4e , < 0ae40b2d0a5de6b045504098e365d4fdff5bbeba (git)
Affected: bf6e054e0e3fbc9614355b760e18c8a14f952a4e , < ff1121d2214b794dc1772081f27bdd90721a84bc (git)
Affected: bf6e054e0e3fbc9614355b760e18c8a14f952a4e , < 45fc8d20e0768ab0a0ad054081d0f68aa3c83976 (git)
Affected: bf6e054e0e3fbc9614355b760e18c8a14f952a4e , < 9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.109 , ≤ 6.1.* (semver)
Unaffected: 6.6.37 , ≤ 6.6.* (semver)
Unaffected: 6.9.8 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:53.719Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41096",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:20:22.209715Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:09.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/msi/msi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ae40b2d0a5de6b045504098e365d4fdff5bbeba",
              "status": "affected",
              "version": "bf6e054e0e3fbc9614355b760e18c8a14f952a4e",
              "versionType": "git"
            },
            {
              "lessThan": "ff1121d2214b794dc1772081f27bdd90721a84bc",
              "status": "affected",
              "version": "bf6e054e0e3fbc9614355b760e18c8a14f952a4e",
              "versionType": "git"
            },
            {
              "lessThan": "45fc8d20e0768ab0a0ad054081d0f68aa3c83976",
              "status": "affected",
              "version": "bf6e054e0e3fbc9614355b760e18c8a14f952a4e",
              "versionType": "git"
            },
            {
              "lessThan": "9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1",
              "status": "affected",
              "version": "bf6e054e0e3fbc9614355b760e18c8a14f952a4e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/msi/msi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.37",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/MSI: Fix UAF in msi_capability_init\n\nKFENCE reports the following UAF:\n\n BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488\n\n Use-after-free read at 0x0000000024629571 (in kfence-#12):\n  __pci_enable_msi_range+0x2c0/0x488\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\n  pci_alloc_irq_vectors+0x18/0x28\n\n kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128\n\n allocated by task 81 on cpu 7 at 10.808142s:\n  __kmem_cache_alloc_node+0x1f0/0x2bc\n  kmalloc_trace+0x44/0x138\n  msi_alloc_desc+0x3c/0x9c\n  msi_domain_insert_msi_desc+0x30/0x78\n  msi_setup_msi_desc+0x13c/0x184\n  __pci_enable_msi_range+0x258/0x488\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\n  pci_alloc_irq_vectors+0x18/0x28\n\n freed by task 81 on cpu 7 at 10.811436s:\n  msi_domain_free_descs+0xd4/0x10c\n  msi_domain_free_locked.part.0+0xc0/0x1d8\n  msi_domain_alloc_irqs_all_locked+0xb4/0xbc\n  pci_msi_setup_msi_irqs+0x30/0x4c\n  __pci_enable_msi_range+0x2a8/0x488\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\n  pci_alloc_irq_vectors+0x18/0x28\n\nDescriptor allocation done in:\n__pci_enable_msi_range\n    msi_capability_init\n        msi_setup_msi_desc\n            msi_insert_msi_desc\n                msi_domain_insert_msi_desc\n                    msi_alloc_desc\n                        ...\n\nFreed in case of failure in __msi_domain_alloc_locked()\n__pci_enable_msi_range\n    msi_capability_init\n        pci_msi_setup_msi_irqs\n            msi_domain_alloc_irqs_all_locked\n                msi_domain_alloc_locked\n                    __msi_domain_alloc_locked =\u003e fails\n                    msi_domain_free_locked\n                        ...\n\nThat failure propagates back to pci_msi_setup_msi_irqs() in\nmsi_capability_init() which accesses the descriptor for unmasking in the\nerror exit path.\n\nCure it by copying the descriptor and using the copy for the error exit path\nunmask operation.\n\n[ tglx: Massaged change log ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local interfaces only \u2014 the `VFIO_DEVICE_SET_IRQS` ioctl on a passed-through PCI device, sysfs driver bind/unbind, or device hotplug \u2014 never from network input. Local access to a device file or the sysfs PCI interface is required.\nAC:L - Via VFIO the attacker directly controls the vector count passed to `pci_alloc_irq_vectors()` and can loop enable/disable indefinitely, and the required allocation failure (ITS device-table/LPI exhaustion, x86 vector exhaustion, or `-ENOMEM` in sysfs/irqdomain allocation) is inducible by attacker-created vector and memory pressure. The freed object lives in the generic sprayable `kmalloc-128` cache and the free path sleeps, so reclaim is not an uncontrollable race.\nPR:L - In the standard device-passthrough deployment the vfio group/device fd is handed to an unprivileged VMM account, and `vfio_pci_ioctl_set_irqs()` performs no capability check for the IOMMU-backed path (`CAP_SYS_RAWIO` gates only no-IOMMU mode). A basic local user holding that descriptor can drive `msi_capability_init()` repeatedly.\nUI:N - The attacker triggers the MSI enable path entirely through their own ioctl calls, with no action by any other user or administrator required.\nS:U - The use-after-free corrupts kernel slab memory and is confined to the kernel\u0027s own security authority; no IOMMU, hypervisor, or sandbox boundary is crossed by the defect itself.\nC:H - The freed `msi_desc` is read after free, including the `desc-\u003edev` pointer that is then dereferenced through `pci_write_config_dword()`; controlling the reclaimed `kmalloc-128` object turns this into an arbitrary kernel read primitive and full memory disclosure.\nI:H - `pci_msi_update_mask()` writes back into the freed object (`desc-\u003epci.msi_mask \u0026= ~clear`), corrupting whatever now occupies the slot, and dereferences `dev-\u003ebus-\u003eops-\u003ewrite` from freed memory \u2014 a control-flow hijack primitive enabling arbitrary write and code execution.\nA:H - The use-after-free dereferences stale pointers and takes a spinlock at an address read from freed memory, reliably producing an oops or kernel panic even when not weaponized, as confirmed by the KFENCE report in the fix commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:21.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ae40b2d0a5de6b045504098e365d4fdff5bbeba"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1"
        }
      ],
      "title": "PCI/MSI: Fix UAF in msi_capability_init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41096",
    "datePublished": "2024-07-29T15:48:09.247Z",
    "dateReserved": "2024-07-12T12:17:45.637Z",
    "dateUpdated": "2026-08-05T11:35:21.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41096",
      "date": "2026-09-17",
      "epss": "0.0024",
      "percentile": "0.1534"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:18:45.000Z",
      "cve": "CVE-2024-41096",
      "id": "msrc_CVE-2024-41096",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "PCI/MSI: Fix UAF in msi_capability_init",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41096.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41096\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T16:15:04.683\",\"lastModified\":\"2026-08-04T11:19:29.450\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/MSI: Fix UAF in msi_capability_init\\n\\nKFENCE reports the following UAF:\\n\\n BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488\\n\\n Use-after-free read at 0x0000000024629571 (in kfence-#12):\\n  __pci_enable_msi_range+0x2c0/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\n kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128\\n\\n allocated by task 81 on cpu 7 at 10.808142s:\\n  __kmem_cache_alloc_node+0x1f0/0x2bc\\n  kmalloc_trace+0x44/0x138\\n  msi_alloc_desc+0x3c/0x9c\\n  msi_domain_insert_msi_desc+0x30/0x78\\n  msi_setup_msi_desc+0x13c/0x184\\n  __pci_enable_msi_range+0x258/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\n freed by task 81 on cpu 7 at 10.811436s:\\n  msi_domain_free_descs+0xd4/0x10c\\n  msi_domain_free_locked.part.0+0xc0/0x1d8\\n  msi_domain_alloc_irqs_all_locked+0xb4/0xbc\\n  pci_msi_setup_msi_irqs+0x30/0x4c\\n  __pci_enable_msi_range+0x2a8/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\nDescriptor allocation done in:\\n__pci_enable_msi_range\\n    msi_capability_init\\n        msi_setup_msi_desc\\n            msi_insert_msi_desc\\n                msi_domain_insert_msi_desc\\n                    msi_alloc_desc\\n                        ...\\n\\nFreed in case of failure in __msi_domain_alloc_locked()\\n__pci_enable_msi_range\\n    msi_capability_init\\n        pci_msi_setup_msi_irqs\\n            msi_domain_alloc_irqs_all_locked\\n                msi_domain_alloc_locked\\n                    __msi_domain_alloc_locked =\u003e fails\\n                    msi_domain_free_locked\\n                        ...\\n\\nThat failure propagates back to pci_msi_setup_msi_irqs() in\\nmsi_capability_init() which accesses the descriptor for unmasking in the\\nerror exit path.\\n\\nCure it by copying the descriptor and using the copy for the error exit path\\nunmask operation.\\n\\n[ tglx: Massaged change log ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI/MSI: corrige UAF en msi_capability_init KFENCE informa el siguiente UAF: ERROR: KFENCE: lectura de uso despu\u00e9s de liberaci\u00f3n en __pci_enable_msi_range+0x2c0/0x488 Lectura de uso despu\u00e9s de liberaci\u00f3n en 0x0000000024629571 (en kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 kfence-#12: 0x0000000008614900-0x00000000e06c22 8d, tama\u00f1o=104, cach\u00e9=kmalloc-128 asignado por la tarea 81 en la CPU 7 en 10.808142 s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0 x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 liberado por la tarea 81 en la CPU 7 en 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+ 0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 Asignaci\u00f3n de descriptores realizada en: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ... Liberado en caso de fallo en __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_ domain_alloc_locked =\u0026gt; falla msi_domain_free_locked... Ese error se propaga nuevamente a pci_msi_setup_msi_irqs() en msi_capability_init() que accede al descriptor para desenmascarar en la salida de error camino. Sor\u00e9guelo copiando el descriptor y usando la copia para la operaci\u00f3n de desenmascarar la ruta de salida del error. [tglx: registro de cambios masajeado]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pci/msi/msi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\",\"lessThan\":\"0ae40b2d0a5de6b045504098e365d4fdff5bbeba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\",\"lessThan\":\"ff1121d2214b794dc1772081f27bdd90721a84bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\",\"lessThan\":\"45fc8d20e0768ab0a0ad054081d0f68aa3c83976\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\",\"lessThan\":\"9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pci/msi/msi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.109\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.37\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.8\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:20:22.209715Z\",\"id\":\"CVE-2024-41096\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.109\",\"matchCriteriaId\":\"D26A7F9F-B969-4382-8C7D-B7C3950BA178\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.37\",\"matchCriteriaId\":\"D72E033B-5323-4C4D-8818-36E1EBC3535F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.8\",\"matchCriteriaId\":\"E95105F2-32E3-4C5F-9D18-7AEFD0E6275C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ae40b2d0a5de6b045504098e365d4fdff5bbeba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:33:12+00:00",
      "cve": "CVE-2024-41096",
      "id": "CVE-2024-41096",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: PCI/MSI: Fix UAF in msi_capability_init",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41096.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.351Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41096\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:20:22.209715Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.786Z\"}}], \"cna\": {\"title\": \"PCI/MSI: Fix UAF in msi_capability_init\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\", \"lessThan\": \"0ae40b2d0a5de6b045504098e365d4fdff5bbeba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\", \"lessThan\": \"ff1121d2214b794dc1772081f27bdd90721a84bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\", \"lessThan\": \"45fc8d20e0768ab0a0ad054081d0f68aa3c83976\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf6e054e0e3fbc9614355b760e18c8a14f952a4e\", \"lessThan\": \"9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/pci/msi/msi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.37\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/pci/msi/msi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0ae40b2d0a5de6b045504098e365d4fdff5bbeba\"}, {\"url\": \"https://git.kernel.org/stable/c/ff1121d2214b794dc1772081f27bdd90721a84bc\"}, {\"url\": \"https://git.kernel.org/stable/c/45fc8d20e0768ab0a0ad054081d0f68aa3c83976\"}, {\"url\": \"https://git.kernel.org/stable/c/9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/MSI: Fix UAF in msi_capability_init\\n\\nKFENCE reports the following UAF:\\n\\n BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488\\n\\n Use-after-free read at 0x0000000024629571 (in kfence-#12):\\n  __pci_enable_msi_range+0x2c0/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\n kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128\\n\\n allocated by task 81 on cpu 7 at 10.808142s:\\n  __kmem_cache_alloc_node+0x1f0/0x2bc\\n  kmalloc_trace+0x44/0x138\\n  msi_alloc_desc+0x3c/0x9c\\n  msi_domain_insert_msi_desc+0x30/0x78\\n  msi_setup_msi_desc+0x13c/0x184\\n  __pci_enable_msi_range+0x258/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\n freed by task 81 on cpu 7 at 10.811436s:\\n  msi_domain_free_descs+0xd4/0x10c\\n  msi_domain_free_locked.part.0+0xc0/0x1d8\\n  msi_domain_alloc_irqs_all_locked+0xb4/0xbc\\n  pci_msi_setup_msi_irqs+0x30/0x4c\\n  __pci_enable_msi_range+0x2a8/0x488\\n  pci_alloc_irq_vectors_affinity+0xec/0x14c\\n  pci_alloc_irq_vectors+0x18/0x28\\n\\nDescriptor allocation done in:\\n__pci_enable_msi_range\\n    msi_capability_init\\n        msi_setup_msi_desc\\n            msi_insert_msi_desc\\n                msi_domain_insert_msi_desc\\n                    msi_alloc_desc\\n                        ...\\n\\nFreed in case of failure in __msi_domain_alloc_locked()\\n__pci_enable_msi_range\\n    msi_capability_init\\n        pci_msi_setup_msi_irqs\\n            msi_domain_alloc_irqs_all_locked\\n                msi_domain_alloc_locked\\n                    __msi_domain_alloc_locked =\u003e fails\\n                    msi_domain_free_locked\\n                        ...\\n\\nThat failure propagates back to pci_msi_setup_msi_irqs() in\\nmsi_capability_init() which accesses the descriptor for unmasking in the\\nerror exit path.\\n\\nCure it by copying the descriptor and using the copy for the error exit path\\nunmask operation.\\n\\n[ tglx: Massaged change log ]\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:11:56.250Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41096\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:11:56.250Z\", \"dateReserved\": \"2024-07-12T12:17:45.637Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T15:48:09.247Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.