CVE-2024-42104 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-42104?

CVE-2024-42104 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's nilfs2 filesystem allows attackers with local access to trigger kernel crashes or potentially execute arbitrary code by mounting specially crafted corrupted filesystem images. This affects systems using the nilfs2 filesystem, primarily Linux servers and workstations.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's nilfs2 filesystem allows attackers with local access to trigger kernel crashes or potentially execute arbitrary code by mounting specially crafted corrupted filesystem images. This affects systems using the nilfs2 filesystem, primarily Linux servers and workstations.

💻 Affected Systems

Products:

Linux kernel with nilfs2 filesystem support

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with nilfs2 support enabled

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when nilfs2 filesystem is in use. Many distributions don't enable nilfs2 by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel-level code execution

🟠

Likely Case

System crash or denial of service through kernel panic when mounting malicious nilfs2 filesystems

🟢

If Mitigated

No impact if nilfs2 filesystem is not used or if systems are properly patched

🌐 Internet-Facing: LOW - Requires local filesystem access, not directly exploitable over network

🏢 Internal Only: MEDIUM - Local attackers or malicious users could crash systems or potentially escalate privileges

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to mount malicious nilfs2 filesystem images, typically requiring local access or ability to upload files

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 07c176e7acc5, 1b7d549ed2c1, 265fff1a01cd, 2f2fa9cf7c35, or 3ab40870edb8

Vendor Advisory: https://git.kernel.org/stable/c/07c176e7acc5579c133bb923ab21316d192d0a95

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable nilfs2 module

linux

Prevent loading of nilfs2 kernel module to eliminate attack surface

echo 'install nilfs2 /bin/false' >> /etc/modprobe.d/disable-nilfs2.conf
rmmod nilfs2 2>/dev/null || true

Mount restrictions

linux

Restrict who can mount filesystems using mount permissions

chmod 700 /bin/mount
setfacl -m u:root:rwx /bin/mount

🧯 If You Can't Patch

Disable nilfs2 filesystem support in kernel configuration
Implement strict access controls to prevent unauthorized users from mounting filesystems

🔍 How to Verify

Check if Vulnerable:

Check if nilfs2 module is loaded: lsmod | grep nilfs2. If loaded and kernel version is unpatched, system is vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits: uname -r and verify with distribution security advisory. Ensure nilfs2 module loads without issues.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
nilfs2 mount failures or corruption warnings
Use-after-free or lru_add_fn error messages

Network Indicators:

None - local filesystem attack

SIEM Query:

source="kernel" AND ("nilfs2" OR "use-after-free" OR "lru_add_fn")

📊 Metadata

CVE ID: CVE-2024-42104

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: July 30, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42104, you might also want to check these: