Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0076 52.5 —
AFFECTED Product Versions Fixed Linux 0e04dc26cc594d31ee6b1382b452b6bc83b57937 – — Linux 4.6 – 4.19.318
TIMELINE Jul 30 Reserved by Linux Aug 7 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-42232 (Linux). CVSS 9.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: - clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() - bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting) - call cancel_delayed_work_sync() after the session is closed
| Date | Event | Detail |
|---|---|---|
| July 30, 2024 | Reserved | Reserved by Linux |
| August 7, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-42232 (Linux). CVSS 9.8 → 5.5 (NVD). |
Authoritative record: CVE-2024-42232 at cve.org
Vendors: linux
Weaknesses: CWE-416
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-42232 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.