CVE-2024-42094 – This CVE describes a stack overflow vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-42094?

CVE-2024-42094 has a CVSS score of 7.1 (HIGH). This CVE describes a stack overflow vulnerability in the Linux kernel's net/iucv component when CONFIG_CPUMASK_OFFSTACK=y is configured. The vulnerability occurs due to improper cpumask variable allocation on the stack, which could lead to kernel crashes or potential privilege escalation. Systems running affected Linux kernel versions with the IUCV networking feature enabled and CONFIG_CPUMASK_OFFSTACK=y are vulnerable.

📋 TL;DR

This CVE describes a stack overflow vulnerability in the Linux kernel's net/iucv component when CONFIG_CPUMASK_OFFSTACK=y is configured. The vulnerability occurs due to improper cpumask variable allocation on the stack, which could lead to kernel crashes or potential privilege escalation. Systems running affected Linux kernel versions with the IUCV networking feature enabled and CONFIG_CPUMASK_OFFSTACK=y are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit history for exact ranges

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when CONFIG_CPUMASK_OFFSTACK=y is enabled and IUCV networking is used. Most standard distributions do not enable CONFIG_CPUMASK_OFFSTACK by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel mode allowing complete system compromise.

🟠

Likely Case

Kernel crash causing system instability or denial of service, requiring reboot to restore functionality.

🟢

If Mitigated

No impact if CONFIG_CPUMASK_OFFSTACK=y is not enabled or IUCV networking is not used.

🌐 Internet-Facing: LOW - IUCV is primarily used for mainframe communication and not typically exposed to internet-facing interfaces.

🏢 Internal Only: MEDIUM - Internal systems using IUCV for mainframe connectivity could experience service disruption if exploited.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires local access and specific kernel configuration. The vulnerability is in a niche networking component (IUCV) primarily used in mainframe environments.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel commit 0af718a690acc089aa1bbb95a93df833d864ef53 and related commits

Vendor Advisory: https://git.kernel.org/stable/c/0af718a690acc089aa1bbb95a93df833d864ef53

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version containing commit 0af718a690acc089aa1bbb95a93df833d864ef53. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable CONFIG_CPUMASK_OFFSTACK

linux

Set CONFIG_CPUMASK_OFFSTACK=n in kernel configuration to avoid vulnerable code path

Edit kernel config file and set CONFIG_CPUMASK_OFFSTACK=n
Recompile and install kernel if using custom build

Disable IUCV networking

linux

Remove or disable IUCV networking module if not required

modprobe -r iucv
Add 'blacklist iucv' to /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable IUCV networking module if not required for operations
Ensure CONFIG_CPUMASK_OFFSTACK is disabled in kernel configuration

🔍 How to Verify

Check if Vulnerable:

Check kernel version and configuration: 1. Check if IUCV module is loaded: lsmod | grep iucv 2. Check kernel config: grep CONFIG_CPUMASK_OFFSTACK /boot/config-$(uname -r)

Check Version:

uname -r

Verify Fix Applied:

Verify kernel contains fix commit: 1. Check kernel version: uname -r 2. Verify commit exists: git log --oneline | grep '0af718a690acc089aa1bbb95a93df833d864ef53' (if kernel source available)

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
System crash/reboot events without clear cause
IUCV-related error messages

Network Indicators:

Unusual IUCV protocol activity if monitored

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "general protection fault") AND process="iucv"

📊 Metadata

CVE ID: CVE-2024-42094

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-787

Published: July 29, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42094, you might also want to check these: