CVE-2024-42285
A critical vulnerability in the Linux kernel’s RDMA/iwcm subsystem can allow an attacker to trigger a use‑after‑free, potentially leading to arbitrary code execution. The flaw occurs when destroying connection manager IDs and has been fixed in the kernel. Users should update to a patched kernel version.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, any distribution that uses an unpatched kernel.
Real-world impact
An attacker could crash the system or execute arbitrary code, potentially taking control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
- 011. Update your Linux kernel to a version that includes the fix for CVE-2024-42285.
- 022. Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Aug 17, 2024 · Aug 17, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/557d035fe88d78dd51…patch
- git.kernel.org/stable/c/7f25f296fc9bd0435b…patch
- git.kernel.org/stable/c/94ee7ff99b87435ec6…patch
- git.kernel.org/stable/c/aee2424246f9f1dadc…patch
- git.kernel.org/stable/c/d91d253c87fd1efece…patch
- git.kernel.org/stable/c/dc8074b8901caabb97…patch
- git.kernel.org/stable/c/ee39384ee787e86e9d…patch
- git.kernel.org/stable/c/ff5bbbdee08287d75d…patch
- lists.debian.org/debian-lts-announce/2024/10…
- lists.debian.org/debian-lts-announce/2025/01…