{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-23T04:15:43.330","vulnerabilities":[{"cve":{"id":"CVE-2024-42302","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2024-08-17T09:15:10.487","lastModified":"2026-03-27T20:56:40.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\n\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\n\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred.  To do so, it polls the\nconfig space of the first child device on the secondary bus.  If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\n\nThat's because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device.  Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume.  Holding a\nreference wasn't necessary back then because the pciehp IRQ thread\ncould never run concurrently.  (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase.  And runtime resume is\nalways awaited before a PCI device is removed.)\n\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event.  Commit 53b54ad074de (\"PCI/DPC: Await readiness\nof secondary bus after reset\"), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently.  The commit was backported to v5.10+ stable\nkernels, so that's the oldest one affected.\n\nAdd the missing reference acquisition.\n\nAbridged stack trace:\n\n  BUG: unable to handle page fault for address: 00000000091400c0\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n  RIP: pci_bus_read_config_dword+0x17/0x50\n  pci_dev_wait()\n  pci_bridge_wait_for_secondary_bus()\n  dpc_reset_link()\n  pcie_do_recovery()\n  dpc_handler()"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI/DPC: corrige el use-after-free en DPC simultáneos y la eliminación en caliente. Keith informa un use-after-free cuando ocurre un evento de DPC simultáneamente con la eliminación en caliente del mismo. parte de la jerarquía: dpc_handler() espera que el bus secundario esté listo debajo del puerto descendente donde ocurrió el evento DPC. Para hacerlo, sondea el espacio de configuración del primer dispositivo secundario en el bus secundario. Si ese dispositivo secundario se elimina simultáneamente, los accesos a su estructura pci_dev hacen que el kernel falle. Esto se debe a que pci_bridge_wait_for_secondary_bus() no mantiene una referencia en el dispositivo secundario. Antes de v6.3, la función solo se llamaba al reanudar desde la suspensión del sistema o al reanudar el tiempo de ejecución. Mantener una referencia no era necesario en aquel entonces porque el subproceso pciehp IRQ nunca podía ejecutarse al mismo tiempo. (Al reanudar desde la suspensión del sistema, las IRQ no se habilitan hasta después de la fase resume_noirq. Y la reanudación del tiempo de ejecución siempre se espera antes de que se elimine un dispositivo PCI). Sin embargo, a partir de v6.3, pci_bridge_wait_for_secondary_bus() también se llama en un evento DPC. El commit 53b54ad074de (\"PCI/DPC: Esperar la preparación del bus secundario después del reinicio\"), que introdujo eso, no pudo apreciar que pci_bridge_wait_for_secundary_bus() ahora necesita mantener una referencia en el dispositivo secundario porque dpc_handler() y pciehp pueden ejecutarse simultáneamente. El commit fue respaldada a núcleos estables v5.10+, por lo que ese es el más antiguo afectado. Agregue la adquisición de referencia que falta. Seguimiento de pila abreviado: ERROR: no se puede manejar el error de página para la dirección: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() _hacer_recuperación () dpc_handler()"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.176","versionEndExcluding":"5.10.224","matchCriteriaId":"C98CFA20-AB27-454D-A2A1-42C2845D5F97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.104","versionEndExcluding":"5.15.165","matchCriteriaId":"D5B8FAF3-97AD-4F48-A63F-0AB4E7023E54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.16","versionEndExcluding":"6.1.103","matchCriteriaId":"B39E1F86-8FA3-4F91-8B0E-EA7D82E7DEA1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.3","versionEndExcluding":"6.6.44","matchCriteriaId":"0DEF01C3-011C-499A-8F1E-251EA9954B52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.10.3","matchCriteriaId":"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}]}