VYPR
← All advisories
High severity7.8NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42302

CVE-2024-42302

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal

Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy:

The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops.

That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.)

However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected.

Add the missing reference acquisition.

Abridged stack trace:

BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler()

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in Linux kernel's PCI/DPC subsystem allows local privilege escalation when concurrent DPC and hot-removal occur.

Vulnerability

CVE-2024-42302 is a use-after-free bug in the Linux kernel's PCI Downstream Port Containment (DPC) subsystem. The function pci_bridge_wait_for_secondary_bus() polls the configuration space of the first child device on the secondary bus after a DPC event, accessing the child's struct pci_dev without holding a reference. If a hot-removal of that child device occurs concurrently, the kernel can access freed memory, leading to a crash or potential privilege escalation [1].

Exploitation

An attacker with local access and the ability to trigger a DPC event (for example, via an error injection on a PCI device) and simultaneously initiate hot-removal can exploit this race condition. The issue affects kernel versions from v5.10 onward, after commit 53b54ad074de backported the vulnerable code path. No special privileges beyond local access are required; however, the victim must be able to induce a DPC event and a concurrent hot-removal operation [1].

Impact

Successful exploitation can cause a denial of service via kernel panic (as shown in the kernel BUG trace) or, in some cases, allow an attacker to execute arbitrary code with kernel privileges, leading to full system compromise. The Siemens advisory lists CVE-2024-42302 among multiple CVEs affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem [1].

Mitigation

The Linux kernel has patched this vulnerability by adding the missing reference acquisition on the child device. Persistent fixes are included in stable branches [2][3][4]. Users should apply the latest kernel updates from their distribution. Siemens provides remediation guidance for affected products in their advisory [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

98

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.