VYPR
← All advisories
High severity7.3NVD Advisory· Published Jul 29, 2024· Updated May 12, 2026

CVE-2024-42093

CVE-2024-42093

Description

In the Linux kernel, the following vulnerability has been resolved:

net/dpaa2: Avoid explicit cpumask var allocation on stack

For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow.

Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK.

Use *cpumask_var API(s) to address it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-42093: Linux kernel net/dpaa2 fix avoids stack-allocated cpumask variable, preventing potential stack overflow on configurations with CONFIG_CPUMASK_OFFSTACK=y.

Vulnerability

Description

CVE-2024-42093 addresses a stack memory safety issue in the Linux kernel's net/dpaa2 driver. The root cause is the explicit declaration of a cpumask variable on the stack. On kernel builds with CONFIG_CPUMASK_OFFSTACK=y, allocating large CPU masks directly on the stack is discouraged because it can lead to stack overflow, potentially causing a denial-of-service (DoS) or memory corruption [1][2]. The official patch replaces this stack allocation with the proper cpumask_var API, which uses dynamic allocation when needed [4].

Exploitation

This is a locally exploitable vulnerability. An attacker must already have the ability to load or trigger the net/dpaa2 driver code path that allocates the cpumask variable on the stack. The attack vector is local, requiring no prior authentication beyond normal system access, and the complexity is low if the system uses CONFIG_CPUMASK_OFFSTACK=y [1][4]. No network-based attack is involved; the attacker must be able to invoke the vulnerable kernel code.

Impact

If successfully exploited, the stack overflow could crash the system or lead to unpredictable behavior, resulting in a denial-of-service (DoS). The CVSS v3 base score is 7.3 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, indicating high availability impact and no confidentiality or integrity impact [1]. Informally, the vulnerability could allow a local user to cause a system crash.

Mitigation

The vulnerability is fixed in the Linux kernel by commit 763896ab62a672d728f5eb10ac90d98c607a8509 [4]. System administrators should apply the latest stable kernel updates from their distribution. The issue also affects Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem [1], and users of that product should apply the vendor-recommended patches. No workaround is available; updating the kernel is the only mitigation.

References
  1. SSA-265688
  2. SSA-355557
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

168

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.