CVE-2024-42302 is a use-after-free vulnerability in the Linux kernel affecting the PCI subsystem, specifically related to Downstream Port Containment (DPC) events and hot-removal of PCI devices. The vulnerability arises when the dpc_handler() function waits for readiness of the secondary bus below a Downstream Port where a DPC event occurred. It does so by polling the configuration space of the first child device on the secondary bus. If this child device is concurrently removed (hot-removed), the kernel attempts to access a freed pci_dev structure, leading to a use-after-free condition and a kernel oops (crash). This occurs because pci_bridge_wait_for_secondary_bus() does not hold a reference to the child device, which is necessary to prevent the device structure from being freed during concurrent operations. Prior to Linux kernel version 6.3, this function was only called during system resume phases where concurrent IRQ handling was not possible, so holding a reference was unnecessary. However, starting with version 6.3, pci_bridge_wait_for_secondary_bus() is also called during DPC events, which can run concurrently with PCI hotplug IRQ threads, exposing the race condition. The issue was introduced by commit 53b54ad074de, which backported this behavior to stable kernels from version 5.10 onwards, thus widening the affected kernel versions. The vulnerability can cause kernel crashes and potential denial of service due to the kernel oops triggered by accessing freed memory. No known exploits have been reported in the wild yet. The patch involves adding the missing reference acquisition to the child device to prevent premature freeing during concurrent access. The vulnerability affects Linux kernels from 5.10+ stable releases through 6.9.0 and likely beyond until patched.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with PCI devices that support DPC and that may be hot-removed or reset concurrently. This includes servers, workstations, and embedded systems in data centers, industrial control, and telecommunications infrastructure. The impact is mainly denial of service through kernel crashes, which can disrupt critical services and operations. In environments with high availability requirements, such as financial institutions, healthcare providers, and critical infrastructure operators, unexpected kernel panics can lead to service outages, data loss, and operational downtime. Although no direct remote code execution or privilege escalation is indicated, the denial of service could be leveraged as part of a broader attack chain. European organizations relying on Linux-based virtualization hosts, cloud infrastructure, or edge computing devices are particularly at risk if they use affected kernel versions and PCI devices subject to hot-removal or DPC events. The lack of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits given the public disclosure. The vulnerability also highlights the importance of kernel stability in PCI device management, which is critical in environments with dynamic hardware configurations.

European organizations should prioritize updating Linux kernels to versions where this vulnerability is patched. Specifically, kernel versions post-6.3 with the fix for commit 53b54ad074de or later stable releases should be deployed. For environments where immediate kernel upgrades are not feasible, organizations should consider disabling PCI DPC events or hot-removal features if possible, to reduce the likelihood of concurrent access triggering the vulnerability. System administrators should audit their PCI device configurations and hotplug usage to identify systems at risk. Monitoring kernel logs for pci_bus_read_config_dword errors or kernel oops related to PCI devices can help detect exploitation attempts or crashes. Additionally, organizations should implement robust system recovery and failover mechanisms to minimize downtime from potential kernel panics. Coordination with Linux distribution vendors for timely patch deployment and testing in staging environments is critical. Finally, security teams should maintain awareness of any emerging exploits targeting this vulnerability and update incident response plans accordingly.