CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-29 · updated 2026-08-04
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels.

Affected products

Linux kernel: from 2.6.14 before 4.19.319; from 4.20 before 5.4.281; from 5.5 before 5.10.223; from 5.11 before 5.15.164; from 5.16 before 6.1.102; from 6.2 before 6.6.43 — fixed in 4.19.319, 5.10.223, 5.15.164, 5.4.281, 6.1.102, 6.10.2

How to fix

Upgrade to a fixed version: Linux kernel 4.19.319, 5.10.223, 5.15.164, 5.4.281. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-41020 or the next vulnerability affects your stack