{"cve":"CVE-2024-41020","nvd":{"published":"2024-07-29T14:15:03.773","modified":"2026-08-04T11:19:18.830","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Fix fcntl/close race recovery compat path\n\nWhen I wrote commit 3cad1bc01041 (\"filelock: Remove locks reliably when\nfcntl/close race is detected\"), I missed that there are two copies of the\ncode I was patching: The normal version, and the version for 64-bit offsets\non 32-bit kernels.\nThanks to Greg KH for stumbling over this while doing the stable\nbackport...\n\nApply exactly the same fix to the compat path for 32-bit kernels.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","score":4.7},"cwes":["CWE-362"],"references":["https://git.kernel.org/stable/c/4c43ad4ab41602201d34c66ac62130fe339d686f","https://git.kernel.org/stable/c/53e21cfa68a7d12de378b7116c75571f73e0dfa2","https://git.kernel.org/stable/c/5b0af8e4c70e4b884bb94ff5f0cd49ecf1273c02","https://git.kernel.org/stable/c/73ae349534ebc377328e7d21891e589626c6e82c","https://git.kernel.org/stable/c/911cc83e56a2de5a40758766c6a70d6998248860"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-41020","score":0.00195,"percentile":0.09261,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}