{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:30:29.384Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:19:49.454221Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:08.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3243e64eb4d897c3eeb48b2a7221ab5a95e1282a",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "ed45c0a0b662079d4c0e518014cc148c753979b4",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            },
            {
              "lessThan": "1864b8224195d0e43ddb92a8151f54f6562090cc",
              "status": "affected",
              "version": "a69839d4327d053b18d8e1b0e7ddeee78db78f4f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.37",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn\u0027t call kfree(madev) again\nin the error handling path. Set \u0027madev\u0027 to NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `add_adev()` is reached only through the MANA PCI probe/resume paths (`mana_gd_probe()`/`mana_gd_resume()` \u2192 `mana_probe()`), driven by local device binding, PCI hot-add and power-management events. No remotely received network data reaches this code, and the failing `auxiliary_device_add()` name/id are kernel-generated, so even a malicious device cannot steer it.\nAC:L - The only precondition is an allocation failure inside `dev_set_name()`/`device_add()`, which a local attacker can induce by driving the system into memory pressure while repeatedly cycling the probe path until the window is hit. Nothing in the path depends on state outside the attacker\u0027s influence, and the attempt can be retried indefinitely.\nPR:L - The triggering condition \u2014 memory exhaustion making `GFP_KERNEL` allocations fail \u2014 is fully inducible by an ordinary unprivileged local user, and MANA probe events also occur unprivileged in Azure guests (boot, host-initiated VF hot-add/revoke during servicing and live migration). This matches the scoring of CVE-2026-43056, the sibling defect in the identical error path of this same function.\nUI:N - The entire sequence runs inside kernel probe/resume context with no human action required \u2014 no mount, file open, or click. Probe is driven by the PCI/driver core and by host-initiated hotplug.\nS:U - The double free and use-after-free corrupt kernel slab objects within the same security authority as the vulnerable driver. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `mana_adev_idx_free(adev-\u003eid)` reads `adev-\u003eid` out of memory already released by `adev_release()`, and the subsequent double free creates a SLUB freelist cycle that hands the same `kmalloc-1k`/`kmalloc-2k` object to two independent allocations. Because that is a general-purpose cache shared with attacker-sprayable objects, the resulting type confusion is leverageable into a kernel memory disclosure primitive.\nI:H - A double free giving two owners of one slab object is the classic dup-alloc primitive: the attacker reclaims the chunk with a groomed structure while the driver still writes through the stale `struct device`/`auxiliary_device` fields, yielding arbitrary write and function-pointer hijack. The stale `adev-\u003eid` is additionally fed into `ida_free()`, corrupting global IDA allocator state.\nA:H - On kernels with `CONFIG_SLAB_FREELIST_HARDENED`, the immediate re-free trips `set_freepointer()`\u0027s `BUG_ON(object == fp)` for a hard kernel panic; without it, the poisoned freelist causes an oops or arbitrary corruption shortly after. Either outcome takes down the machine and can be re-triggered on every probe cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:28.180Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3243e64eb4d897c3eeb48b2a7221ab5a95e1282a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed45c0a0b662079d4c0e518014cc148c753979b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1864b8224195d0e43ddb92a8151f54f6562090cc"
        }
      ],
      "title": "net: mana: Fix possible double free in error handling path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42069",
    "datePublished": "2024-07-29T15:52:33.273Z",
    "dateReserved": "2024-07-29T15:50:41.168Z",
    "dateUpdated": "2026-08-05T11:35:28.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}