7.8

CVE-2024-39292: linux Double Free

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-39292DEBIAN-CVE-2024-39292
Published 24-06-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-39292 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 17
DLA-3840-1DSA-5730-1MGASA-2024-0263MGASA-2024-0266USN-6951-1USN-6951-2

Timeline

  1. 24-06-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list. If that happens, register_winch_irq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup(). Avoid the race by adding the winch to the winch_handlers list before registering the IRQ, and rolling back if um_request_irq() fails.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

+0.01 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu128 products
  • linuxAll versions (No fix recorded) | < 4.4.0-258.292 | < 4.15.0-228.240 | < 5.4.0-192.212 | < 5.15.0-119.129 | < 6.8.0-41.41
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1135.141 | < 4.4.0-1173.188 | < 4.15.0-1172.185 | < 5.4.0-1130.140 | < 5.15.0-1068.74 | < 6.8.0-1014.15
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 66ea9a7c6824821476914bed21a476cd20094f33 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 351d1a64544944b44732f6a64ed65573b00b9e14 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 31960d991e43c8d6dc07245f19fc13398e90ead2 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 0c02d425a2fbe52643a5859a779db0329e7dddd4 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 434a06c38ee1217a8baa0dd7c37cc85d50138fb0 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < 73b8e21f76c7dda4905655d2e2c17dc5a73b87f1 | ≥ 42a359e31a0e438b5b978a8f0fecdbd3c86bb033, < a0fbbd36c156b9f7b2276871d499c9943dfe5101 | 2.6.23
  • linux_kernelEOL< 2.6.23 | ≥ 4.19, < 4.19.316 | ≥ 5.4, < 5.4.278 | ≥ 5.10, < 5.10.219 | ≥ 5.15, < 5.15.161 | ≥ 6.1, < 6.1.93 | ≥ 6.6, < 6.6.33 | ≥ 6.9, < 6.9.4 | 6.10.0:rc1
Debian1 product
  • linux< 6.1.94-1 | < 6.9.7-1

3 vendors · 131 products

References

33 links
Show all 33 references