[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2024-39486":6},{"stargazers_count":4,"fetched_at":5},7,"2026-06-04T08:53:30.047Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":21,"duplicate_of":9,"upstream":22,"downstream":23,"duplicates":64,"related":65,"reserved_at":9,"published_at":73,"modified_at":74,"state":75,"summary":76,"references_raw":84,"kevs":99,"epss":100,"epss_history":103,"metrics":366,"affected":372},"CVE-2024-39486","In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/drm_file: Fix pid refcounting race\n\n\u003Cmaarten.lankhorst@linux.intel.com>, Maxime Ripard\n\u003Cmripard@kernel.org>, Thomas Zimmermann \u003Ctzimmermann@suse.de>\n\nfilp->pid is supposed to be a refcounted pointer; however, before this\npatch, drm_file_update_pid() only increments the refcount of a struct\npid after storing a pointer to it in filp->pid and dropping the\ndev->filelist_mutex, making the following race possible:\n\nprocess A               process B\n=========               =========\n                        begin drm_file_update_pid\n                        mutex_lock(&dev->filelist_mutex)\n                        rcu_replace_pointer(filp->pid, \u003Cpid B>, 1)\n                        mutex_unlock(&dev->filelist_mutex)\nbegin drm_file_update_pid\nmutex_lock(&dev->filelist_mutex)\nrcu_replace_pointer(filp->pid, \u003Cpid A>, 1)\nmutex_unlock(&dev->filelist_mutex)\nget_pid(\u003Cpid A>)\nsynchronize_rcu()\nput_pid(\u003Cpid B>)   *** pid B reaches refcount 0 and is freed here ***\n                        get_pid(\u003Cpid B>)   *** UAF ***\n                        synchronize_rcu()\n                        put_pid(\u003Cpid A>)\n\nAs far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y\nbecause it requires RCU to detect a quiescent state in code that is not\nexplicitly calling into the scheduler.\n\nThis race leads to use-after-free of a \"struct pid\".\nIt is probably somewhat hard to hit because process A has to pass\nthrough a synchronize_rcu() operation while process B is between\nmutex_unlock() and get_pid().\n\nFix it by ensuring that by the time a pointer to the current task's pid\nis stored in the file, an extra reference to the pid has been taken.\n\nThis fix also removes the condition for synchronize_rcu(); I think\nthat optimization is unnecessary complexity, since in that case we\nwould usually have bailed out on the lockless check above.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-416","Use After Free","The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","weakness","Stable","Variant","High",[],[],[],[],[24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54,56,58,60,62],{"_key":25},"SUSE-SU-2024:3194-1",{"_key":27},"SUSE-SU-2024:3195-1",{"_key":29},"SUSE-SU-2024:3383-1",{"_key":31},"SUSE-SU-2025:20044-1",{"_key":33},"SUSE-SU-2025:20047-1",{"_key":35},"MGASA-2024-0263",{"_key":37},"MGASA-2024-0266",{"_key":39},"UBUNTU-CVE-2024-39486",{"_key":41},"DEBIAN-CVE-2024-39486",{"_key":43},"RHSA-2024:9315",{"_key":45},"USN-7089-1",{"_key":47},"USN-7089-2",{"_key":49},"USN-7089-3",{"_key":51},"USN-7089-4",{"_key":53},"USN-7089-5",{"_key":55},"USN-7089-6",{"_key":57},"USN-7089-7",{"_key":59},"USN-7090-1",{"_key":61},"USN-7095-1",{"_key":63},"USN-7156-1",[],[66,67,68,69,70,71,72],{"_key":25},{"_key":27},{"_key":29},{"_key":31},{"_key":33},{"_key":35},{"_key":37},"2024-07-06T09:25:21.514Z","2026-05-23T15:50:17.182Z","Modified",{"cisa_kev":77,"cisa_ransomware":77,"cisa_vendor":9,"epss_severity":78,"epss_score":79,"severity":80,"severity_score":4,"severity_version":81,"severity_source":82,"severity_vector":83,"severity_status":75},false,"low",0.00029,"high","v3.1","nvd","CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",[85,91,95],{"url":86,"sources":87,"tags":89},"https://git.kernel.org/stable/c/16682588ead4a593cf1aebb33b36df4d1e9e4ffa",[88,82],"cve.org",[90],"Patch",{"url":92,"sources":93,"tags":94},"https://git.kernel.org/stable/c/0acce2a5c619ef1abdee783d7fea5eac78ce4844",[88,82],[90],{"url":96,"sources":97,"tags":98},"https://git.kernel.org/stable/c/4f2a129b33a2054e62273edd5a051c34c08d96e9",[88,82],[90],[],{"date":101,"score":79,"percentile":102},"2026-06-03",0.08718,[104,108,111,114,117,120,123,126,129,132,135,138,141,144,147,151,154,157,160,163,166,169,172,175,178,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,255,258,261,263,265,268,271,274,277,280,283,286,288,291,294,297,300,303,306,308,311,314,316,319,322,324,327,330,333,336,339,342,345,348,351,354,356,359,361,364],{"date":105,"score":106,"percentile":107},"2025-11-04",0.00023,0.04783,{"date":109,"score":106,"percentile":110},"2025-11-05",0.04795,{"date":112,"score":106,"percentile":113},"2025-11-06",0.0491,{"date":115,"score":106,"percentile":116},"2025-11-07",0.04917,{"date":118,"score":106,"percentile":119},"2025-11-08",0.04915,{"date":121,"score":106,"percentile":122},"2025-11-09",0.04918,{"date":124,"score":106,"percentile":125},"2025-11-10",0.04899,{"date":127,"score":106,"percentile":128},"2025-11-11",0.04937,{"date":130,"score":106,"percentile":131},"2025-11-12",0.04951,{"date":133,"score":106,"percentile":134},"2025-11-13",0.04984,{"date":136,"score":106,"percentile":137},"2025-11-14",0.05021,{"date":139,"score":106,"percentile":140},"2025-11-15",0.05042,{"date":142,"score":106,"percentile":143},"2025-11-16",0.05054,{"date":145,"score":106,"percentile":146},"2025-11-17",0.05053,{"date":148,"score":149,"percentile":150},"2025-11-18",0.00091,0.2188,{"date":152,"score":149,"percentile":153},"2025-11-19",0.21892,{"date":155,"score":149,"percentile":156},"2025-11-20",0.219,{"date":158,"score":106,"percentile":159},"2025-11-21",0.05103,{"date":161,"score":106,"percentile":162},"2025-11-22",0.05101,{"date":164,"score":106,"percentile":165},"2025-11-23",0.05093,{"date":167,"score":106,"percentile":168},"2025-11-24",0.05077,{"date":170,"score":106,"percentile":171},"2025-11-25",0.05088,{"date":173,"score":106,"percentile":174},"2025-11-26",0.05127,{"date":176,"score":106,"percentile":177},"2025-11-27",0.05145,{"date":179,"score":106,"percentile":174},"2025-11-28",{"date":181,"score":106,"percentile":182},"2025-11-29",0.05176,{"date":184,"score":106,"percentile":185},"2025-11-30",0.05174,{"date":187,"score":106,"percentile":188},"2025-12-01",0.0526,{"date":190,"score":106,"percentile":191},"2025-12-02",0.05275,{"date":193,"score":106,"percentile":194},"2025-12-03",0.05298,{"date":196,"score":106,"percentile":197},"2025-12-04",0.05251,{"date":199,"score":106,"percentile":200},"2025-12-05",0.05315,{"date":202,"score":106,"percentile":203},"2025-12-06",0.05327,{"date":205,"score":106,"percentile":206},"2025-12-07",0.05326,{"date":208,"score":106,"percentile":209},"2025-12-08",0.05331,{"date":211,"score":106,"percentile":212},"2025-12-09",0.05371,{"date":214,"score":106,"percentile":215},"2025-12-10",0.05435,{"date":217,"score":106,"percentile":218},"2025-12-11",0.05438,{"date":220,"score":106,"percentile":221},"2025-12-12",0.05463,{"date":223,"score":106,"percentile":224},"2025-12-13",0.05509,{"date":226,"score":106,"percentile":227},"2025-12-14",0.05488,{"date":229,"score":106,"percentile":230},"2025-12-15",0.05458,{"date":232,"score":106,"percentile":233},"2025-12-16",0.05467,{"date":235,"score":106,"percentile":236},"2025-12-17",0.05532,{"date":238,"score":106,"percentile":239},"2025-12-18",0.05571,{"date":241,"score":106,"percentile":242},"2025-12-19",0.05557,{"date":244,"score":106,"percentile":245},"2025-12-20",0.05554,{"date":247,"score":106,"percentile":248},"2025-12-21",0.05549,{"date":250,"score":106,"percentile":251},"2025-12-22",0.05498,{"date":253,"score":106,"percentile":254},"2025-12-23",0.05511,{"date":256,"score":106,"percentile":257},"2025-12-24",0.05542,{"date":259,"score":106,"percentile":260},"2025-12-25",0.05577,{"date":262,"score":106,"percentile":260},"2025-12-26",{"date":264,"score":106,"percentile":260},"2025-12-27",{"date":266,"score":106,"percentile":267},"2025-12-28",0.05567,{"date":269,"score":106,"percentile":270},"2025-12-29",0.05559,{"date":272,"score":106,"percentile":273},"2025-12-30",0.05521,{"date":275,"score":106,"percentile":276},"2025-12-31",0.05555,{"date":278,"score":106,"percentile":279},"2026-01-01",0.05623,{"date":281,"score":106,"percentile":282},"2026-01-02",0.05617,{"date":284,"score":106,"percentile":285},"2026-01-03",0.0558,{"date":287,"score":106,"percentile":227},"2026-01-04",{"date":289,"score":106,"percentile":290},"2026-01-05",0.05437,{"date":292,"score":106,"percentile":293},"2026-01-06",0.05434,{"date":295,"score":106,"percentile":296},"2026-01-07",0.05455,{"date":298,"score":106,"percentile":299},"2026-01-08",0.05516,{"date":301,"score":106,"percentile":302},"2026-01-09",0.05518,{"date":304,"score":106,"percentile":305},"2026-01-10",0.05525,{"date":307,"score":106,"percentile":254},"2026-01-11",{"date":309,"score":106,"percentile":310},"2026-01-12",0.05507,{"date":312,"score":106,"percentile":313},"2026-01-13",0.05499,{"date":315,"score":106,"percentile":257},"2026-01-14",{"date":317,"score":106,"percentile":318},"2026-01-15",0.05528,{"date":320,"score":106,"percentile":321},"2026-01-16",0.05531,{"date":323,"score":106,"percentile":257},"2026-01-17",{"date":325,"score":106,"percentile":326},"2026-01-18",0.05536,{"date":328,"score":106,"percentile":329},"2026-01-19",0.05496,{"date":331,"score":106,"percentile":332},"2026-01-20",0.05468,{"date":334,"score":106,"percentile":335},"2026-01-21",0.05466,{"date":337,"score":106,"percentile":338},"2026-01-22",0.05447,{"date":340,"score":106,"percentile":341},"2026-01-23",0.05505,{"date":343,"score":106,"percentile":344},"2026-01-24",0.0555,{"date":346,"score":106,"percentile":347},"2026-01-25",0.05497,{"date":349,"score":106,"percentile":350},"2026-01-26",0.05473,{"date":352,"score":106,"percentile":353},"2026-01-27",0.05453,{"date":355,"score":106,"percentile":218},"2026-01-28",{"date":357,"score":106,"percentile":358},"2026-01-29",0.05451,{"date":360,"score":106,"percentile":338},"2026-01-30",{"date":362,"score":106,"percentile":363},"2026-01-31",0.05444,{"date":365,"score":106,"percentile":254},"2026-02-01",[367],{"source":82,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":368,"cvss_v4_0":9},{"baseScore":4,"baseSeverity":369,"vectorString":83,"impactScore":370,"exploitabilityScore":371},"HIGH",9.8,2.6,[373,398],{"ecosystem":9,"name":374,"vendor":375,"product":375,"cpe_part":376,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":377},"Linux","linux","a",[378,385,389,392,396],{"version":379,"is_range":380,"range_type":88,"version_start":381,"version_start_type":382,"version_end":383,"version_end_type":384,"fixed_in":9},">= 031ddd28008971cce0b5626379b910d0a05fb4dd, \u003C 16682588ead4a593cf1aebb33b36df4d1e9e4ffa",true,"031ddd28008971cce0b5626379b910d0a05fb4dd","including","16682588ead4a593cf1aebb33b36df4d1e9e4ffa","excluding",{"version":386,"is_range":380,"range_type":88,"version_start":387,"version_start_type":382,"version_end":388,"version_end_type":384,"fixed_in":9},">= 1c7a387ffef894b1ab3942f0482dac7a6e0a909c, \u003C 0acce2a5c619ef1abdee783d7fea5eac78ce4844","1c7a387ffef894b1ab3942f0482dac7a6e0a909c","0acce2a5c619ef1abdee783d7fea5eac78ce4844",{"version":390,"is_range":380,"range_type":88,"version_start":387,"version_start_type":382,"version_end":391,"version_end_type":384,"fixed_in":9},">= 1c7a387ffef894b1ab3942f0482dac7a6e0a909c, \u003C 4f2a129b33a2054e62273edd5a051c34c08d96e9","4f2a129b33a2054e62273edd5a051c34c08d96e9",{"version":393,"is_range":380,"range_type":88,"version_start":394,"version_start_type":382,"version_end":395,"version_end_type":384,"fixed_in":9},">= 6.6.9, \u003C 6.6.37","6.6.9","6.6.37",{"version":397,"is_range":77,"range_type":88,"version_start":397,"version_start_type":382,"version_end":397,"version_end_type":382,"fixed_in":9},"6.7",{"ecosystem":9,"name":399,"vendor":375,"product":400,"cpe_part":401,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":402},"linux kernel","linux_kernel","o",[403,406,409,411,413,415,417],{"version":404,"is_range":380,"range_type":405,"version_start":394,"version_start_type":382,"version_end":395,"version_end_type":384,"fixed_in":9},"gte6.6.9_lt6.6.37","cpe",{"version":407,"is_range":380,"range_type":405,"version_start":397,"version_start_type":382,"version_end":408,"version_end_type":384,"fixed_in":9},"gte6.7_lt6.9.8","6.9.8",{"version":410,"is_range":77,"range_type":405,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"6.10:rc1",{"version":412,"is_range":77,"range_type":405,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"6.10:rc2",{"version":414,"is_range":77,"range_type":405,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"6.10:rc3",{"version":416,"is_range":77,"range_type":405,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"6.10:rc4",{"version":418,"is_range":77,"range_type":405,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"6.10:rc5"]