Unrated severityNVD Advisory· Published Jul 29, 2024· Updated Nov 3, 2025

PCI/MSI: Fix UAF in msi_capability_init

CVE-2024-41096

Description

In the Linux kernel, the following vulnerability has been resolved:

KFENCE reports the following UAF:

BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488

Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28

kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128

allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28

freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28

Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ...

Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ...

That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path.

Cure it by copying the descriptor and using the copy for the error exit path unmask operation.

[ tglx: Massaged change log ]

Affected products

112

osv-coords111 versions
pkg:rpm/almalinux/bpftool pkg:rpm/almalinux/kernel pkg:rpm/almalinux/kernel-64k pkg:rpm/almalinux/kernel-64k-core pkg:rpm/almalinux/kernel-64k-debug pkg:rpm/almalinux/kernel-64k-debug-core pkg:rpm/almalinux/kernel-64k-debug-devel pkg:rpm/almalinux/kernel-64k-debug-devel-matched pkg:rpm/almalinux/kernel-64k-debug-modules pkg:rpm/almalinux/kernel-64k-debug-modules-core pkg:rpm/almalinux/kernel-64k-debug-modules-extra pkg:rpm/almalinux/kernel-64k-devel pkg:rpm/almalinux/kernel-64k-devel-matched pkg:rpm/almalinux/kernel-64k-modules pkg:rpm/almalinux/kernel-64k-modules-core pkg:rpm/almalinux/kernel-64k-modules-extra pkg:rpm/almalinux/kernel-abi-stablelists pkg:rpm/almalinux/kernel-core pkg:rpm/almalinux/kernel-cross-headers pkg:rpm/almalinux/kernel-debug pkg:rpm/almalinux/kernel-debug-core pkg:rpm/almalinux/kernel-debug-devel pkg:rpm/almalinux/kernel-debug-devel-matched pkg:rpm/almalinux/kernel-debug-modules pkg:rpm/almalinux/kernel-debug-modules-core pkg:rpm/almalinux/kernel-debug-modules-extra pkg:rpm/almalinux/kernel-debug-uki-virt pkg:rpm/almalinux/kernel-devel pkg:rpm/almalinux/kernel-devel-matched pkg:rpm/almalinux/kernel-doc pkg:rpm/almalinux/kernel-headers pkg:rpm/almalinux/kernel-modules pkg:rpm/almalinux/kernel-modules-core pkg:rpm/almalinux/kernel-modules-extra pkg:rpm/almalinux/kernel-rt pkg:rpm/almalinux/kernel-rt-core pkg:rpm/almalinux/kernel-rt-debug pkg:rpm/almalinux/kernel-rt-debug-core pkg:rpm/almalinux/kernel-rt-debug-devel pkg:rpm/almalinux/kernel-rt-debug-modules pkg:rpm/almalinux/kernel-rt-debug-modules-core pkg:rpm/almalinux/kernel-rt-debug-modules-extra pkg:rpm/almalinux/kernel-rt-devel pkg:rpm/almalinux/kernel-rt-modules pkg:rpm/almalinux/kernel-rt-modules-core pkg:rpm/almalinux/kernel-rt-modules-extra pkg:rpm/almalinux/kernel-tools pkg:rpm/almalinux/kernel-tools-libs pkg:rpm/almalinux/kernel-tools-libs-devel pkg:rpm/almalinux/kernel-uki-virt pkg:rpm/almalinux/kernel-zfcpdump pkg:rpm/almalinux/kernel-zfcpdump-core pkg:rpm/almalinux/kernel-zfcpdump-devel pkg:rpm/almalinux/kernel-zfcpdump-devel-matched pkg:rpm/almalinux/kernel-zfcpdump-modules pkg:rpm/almalinux/kernel-zfcpdump-modules-core pkg:rpm/almalinux/kernel-zfcpdump-modules-extra pkg:rpm/almalinux/libperf pkg:rpm/almalinux/perf pkg:rpm/almalinux/python3-perf pkg:rpm/almalinux/rtla pkg:rpm/almalinux/rv pkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-debug&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-rt_debug&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-source-azure&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-source-rt&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-syms-azure&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-syms-rt&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2015.6 pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/kernel-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP6 pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP6 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/kernel-kvmsmall&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-livepatch-MICRO-6-0-RT_Update_2&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-livepatch-MICRO-6-0_Update_2&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-livepatch-SLE15-SP6-RT_Update_2&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6 pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_4&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6 pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/kernel-rt_debug&distro=SUSE%20Real%20Time%20Module%2015%20SP6 pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP6 pkg:rpm/suse/kernel-source-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP6 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP6 pkg:rpm/suse/kernel-syms-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP6 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/kernel-syms-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP6 pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6
< 7.3.0-427.35.1.el9_4+ 110 more
- (no CPE)range: < 7.3.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 5.14.0-427.35.1.el9_4
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1.150600.12.8.3
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.10.8.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1.150600.12.8.3
- (no CPE)range: < 6.4.0-17.1.1.51
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-19.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-19.1
- (no CPE)range: < 1-1.1
- (no CPE)range: < 1-1.1
- (no CPE)range: < 1-150600.1.3.2
- (no CPE)range: < 1-150600.13.3.3
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-10.1
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-19.1
- (no CPE)range: < 6.4.0-10.1
- (no CPE)range: < 6.4.0-150600.10.8.3
- (no CPE)range: < 6.4.0-150600.8.11.1
- (no CPE)range: < 6.4.0-150600.23.22.1
- (no CPE)range: < 6.4.0-150600.10.8.1
- (no CPE)range: < 6.4.0-150600.23.22.1
Linux/Linuxcpe-rescue
Range: 5.17

Patches

9eee5330656b

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv

commit

45fc8d20e076

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv

commit

ff1121d2214b

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv

commit

0ae40b2d0a5d

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv

commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000