VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42306

CVE-2024-42306

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: Avoid using corrupted block bitmap buffer

When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free in the UDF filesystem driver allows local privilege escalation via a corrupted block bitmap buffer.

Vulnerability

CVE-2024-42306 is a use-after-free vulnerability in the UDF filesystem driver (udf) of the Linux kernel. The issue occurs when the filesystem block bitmap is corrupted; the kernel detects the corruption during bitmap loading and fails the allocation, but fails to mark the buffer as invalid. On a subsequent allocation attempt, the kernel reuses the already-loaded bitmap buffer, leading to a use-after-free condition.

Exploitation

Exploitation requires a local attacker with access to a mounted UDF filesystem. By crafting a filesystem with a corrupted block bitmap, the attacker can trigger the use-after-free. No authentication is required beyond local access to the system, and the attacker does not need elevated privileges.

Impact

An attacker successfully exploiting this vulnerability could cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. The CVSS v3 base score is 5.5 (Medium), indicating a moderate severity impact.

Mitigation

The Linux kernel has released patches to address this issue by using the BH_verified bit to properly invalidate the bitmap buffer after detection of corruption. The fix is included in kernel versions after the commit [1] [2]. Users are advised to update their kernel to a patched version or apply the relevant backport.

References
  1. SSA-265688
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

108

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.