5.5

CVE-2024-57949: linux Improper Locking

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-57949DEBIAN-CVE-2024-57949
Published 09-02-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2024-57949 is a medium (CVSS 5.5) Improper Locking vulnerability in linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.2% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10
DLA-4076-1USN-7445-1USN-7448-1USN-7595-1USN-7595-2USN-7595-3

Timeline

  1. 09-02-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irq_set_vcpu_affinity() irq_get_desc_lock() raw_spin_lock_irqsave() <--- Disable interrupts its_irq_set_vcpu_affinity() guard(raw_spinlock_irq) <--- Enables interrupts when leaving the guard() irq_put_desc_unlock() <--- Warns because interrupts are enabled This was broken in commit b97e8a2f7130, which replaced the original raw_spin_[un]lock() pair with guard(raw_spinlock_irq). Fix the issue by using guard(raw_spinlock). [ tglx: Massaged change log ]

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

0.00 pp

From 0.19% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu105 products
  • linux< 6.8.0-62.65
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1030.32
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 2458f2362f695584bd824c922caa07ffc4fe0d5c, < d7b0e89610dd45ac6cf0d6f99bfa9ccc787db344 | ≥ 5c0fb9cb404a2efbbc319ff9d1b877cf4e47e950, < 6c84ff2e788fce0099ee3e71a3ed258b1ca1a223 | ≥ b97e8a2f7130a4b30d1502003095833d16c028b3, < 93955a7788121ab5a0f7f27e988b2ed1135a4866 | ≥ b97e8a2f7130a4b30d1502003095833d16c028b3, < 35cb2c6ce7da545f3b5cb1e6473ad7c3a6f08310 | c11039edbabdbccf0728844f1002d750d06f9eff | ≥ 6.1.95, < 6.1.127 | ≥ 6.6.35, < 6.6.74 | ≥ 6.9.6, < 6.10 | 6.10
  • linux_kernel≥ 6.1.95, < 6.1.127 | ≥ 6.6.35, < 6.6.74 | ≥ 6.9.6, < 6.12.11 | 6.13:rc1 | 6.13:rc2 | 6.13:rc3 | 6.13:rc4 | 6.13:rc5 | 6.13:rc6 | 6.13:rc7
Debian1 product
  • linux< 6.1.128-1 | < 6.12.11-1

3 vendors · 108 products

References

20 links
Show all 20 references