filelock: Fix fcntl/close race recovery compat path

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2024-41020
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-07-29 14:15:03 UTC
Updated2026-08-04 11:19:18 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels.

Risk And Classification

Primary CVSS: v3.1 4.7 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-362

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary4.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d a561145f3ae973ebf3e0aee41624e92a6c5cb38d git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d 4c43ad4ab41602201d34c66ac62130fe339d686f git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d 911cc83e56a2de5a40758766c6a70d6998248860 git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d 53e21cfa68a7d12de378b7116c75571f73e0dfa2 git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d f4d0775c6e2f1340ca0725f0337de149aaa989ca git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d 73ae349534ebc377328e7d21891e589626c6e82c git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d 5b0af8e4c70e4b884bb94ff5f0cd49ecf1273c02 git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d ed898f9ca3fa32c56c858b463ceb9d9936cc69c4 git Not specified
CNA Linux Linux affected c293621bbf678a3d85e3ed721c3921c8a670610d f8138f2ad2f745b9a1c696a05b749eabe44337ea git Not specified
CNA Linux Linux affected 2.6.13 Not specified
CNA Linux Linux unaffected 2.6.13 semver Not specified
CNA Linux Linux unaffected 4.19.319 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.281 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.223 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.164 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.102 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.43 6.6.* semver Not specified
CNA Linux Linux unaffected 6.9.12 6.9.* semver Not specified
CNA Linux Linux unaffected 6.10.2 6.10.* semver Not specified
CNA Linux Linux unaffected 6.11 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/f8138f2ad2f745b9a1c696a05b749eabe44337ea af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/911cc83e56a2de5a40758766c6a70d6998248860 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/f4d0775c6e2f1340ca0725f0337de149aaa989ca af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/a561145f3ae973ebf3e0aee41624e92a6c5cb38d af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/5b0af8e4c70e4b884bb94ff5f0cd49ecf1273c02 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/53e21cfa68a7d12de378b7116c75571f73e0dfa2 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/4c43ad4ab41602201d34c66ac62130fe339d686f af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/01/msg00001.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org
git.kernel.org/stable/c/ed898f9ca3fa32c56c858b463ceb9d9936cc69c4 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/73ae349534ebc377328e7d21891e589626c6e82c af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report