What’s Vulnerable › Vulnerabilities

CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings

• Severity: medium (CVSS 4.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-30 · updated 2026-10-30
• Weakness: CWE-669

Description

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770)

Affected products

• Linux kernel: from 4.11 before 6.9.9 — fixed in 6.9.9
• Linux: 4.11 — fixed in 6.10

How to fix

Upgrade to a fixed version: Linux kernel 6.9.9; Linux 6.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694
• https://git.kernel.org/stable/c/62151a0acde90823bdfa991d598c85cf4b1d387d
• https://git.kernel.org/stable/c/f2e43af834fcc652b324384f14b561cf610742d4
• https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694
• https://git.kernel.org/stable/c/62151a0acde90823bdfa991d598c85cf4b1d387d

Get alerted when CVE-2024-42158 or the next vulnerability affects your stack