{"cve":"CVE-2024-42265","nvd":{"published":"2024-08-17T09:15:07.893","modified":"2026-10-15T01:18:44.810","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of ->fd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than ->max_fds;\nhowever, misprediction might end up with\n        tofree = fdt->fd[fd];\nbeing speculatively executed.  That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt->max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368","https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1","https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f","https://git.kernel.org/stable/c/41a6c31df77bd8e050136b0a200b537da9e1084a","https://git.kernel.org/stable/c/5db999fff545b924b24c9afd368ef5c17279b176"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-42265","score":0.00279,"percentile":0.20155,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}