Cyber Resilience

CVE-2024-39292

Memory Safety in Linux Kernel ≤ 2.6.23

Published
24 June 2024
Modified
04 November 2025
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0023 14th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-39292 is a medium-severity Double Free (CWE-415) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list. If that…

more

happens, register_winch_irq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup(). Avoid the race by adding the winch to the winch_handlers list before registering the IRQ, and rolling back if um_request_irq() fails.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-38582Same product: Linux Linux Kernel
CVE-2025-71238Same product: Linux Linux Kernel
CVE-2026-45891Same product: Linux Linux Kernel
CVE-2026-43097Same product: Linux Linux Kernel
CVE-2024-26930Same product: Linux Linux Kernel
CVE-2024-57980Same product: Linux Linux Kernel
CVE-2023-52930Same product: Linux Linux Kernel
CVE-2024-50159Same product: Linux Linux Kernel
CVE-2024-46673Same product: Linux Linux Kernel
CVE-2024-27433Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
6.10.0 · ≤ 2.6.23 · 4.19 — 4.19.316 · 5.4 — 5.4.278

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent double-free errors via static analysis, safe memory APIs, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect double-free conditions before release.

prevents

Secure development life cycle includes memory-safety practices that can prevent double-free bugs.

prevents

Application security requirements can mandate memory-safety rules that reduce double-free risk.

prevents

Secure system architecture and engineering principles can prescribe safe memory-management patterns.

prevents

Secure coding standards directly address proper use of free() and similar functions.

References