What’s Vulnerable › Vulnerabilities

CVE-2024-42156: s390/pkey: Wipe copies of clear-key structures on failure

• Severity: medium (CVSS 4.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-30 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.

Affected products

• Linux kernel: from 4.11 before 6.9.9 — fixed in 6.9.9
• Linux: 5.4 — fixed in 6.10

How to fix

Upgrade to a fixed version: Linux kernel 6.9.9; Linux 6.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/382f94bb724b41a76030557a29bbffb965d4c0ae
• https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d
• https://git.kernel.org/stable/c/a891938947f4427f98cb1ce54f27223501efe750
• https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073
• https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d
• https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073

Get alerted when CVE-2024-42156 or the next vulnerability affects your stack