---
id: CVE-2024-39292
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  um: Add winch to winch_handlers before registering winch IRQ

  Registering a winch IRQ is racy, an interrupt may occur before the winch is
  added to the winch_handlers li…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  um: Add winch to winch_handlers before registering winch IRQ

  Registering a winch IRQ is racy, an interrupt may occur before the winch is
  added to the winch_handlers li…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-415
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 2.6.23
  - 'linux_kernel >= 4.19, < 4.19.316'
  - 'linux_kernel >= 5.4, < 5.4.278'
  - 'linux_kernel >= 5.10, < 5.10.219'
  - 'linux_kernel >= 5.15, < 5.15.161'
  - 'linux_kernel >= 6.1, < 6.1.93'
  - 'linux_kernel >= 6.6, < 6.6.33'
  - 'linux_kernel >= 6.9, < 6.9.4'
  - linux_kernel = 6.10.0
patched:
  - linux_kernel 6.9.4
published: '2024-06-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:33.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-39292'
references:
  - url: 'https://git.kernel.org/stable/c/0c02d425a2fbe52643a5859a779db0329e7dddd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/31960d991e43c8d6dc07245f19fc13398e90ead2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/351d1a64544944b44732f6a64ed65573b00b9e14'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/434a06c38ee1217a8baa0dd7c37cc85d50138fb0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66ea9a7c6824821476914bed21a476cd20094f33'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/73b8e21f76c7dda4905655d2e2c17dc5a73b87f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a0fbbd36c156b9f7b2276871d499c9943dfe5101'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0c02d425a2fbe52643a5859a779db0329e7dddd4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/31960d991e43c8d6dc07245f19fc13398e90ead2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/351d1a64544944b44732f6a64ed65573b00b9e14'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/434a06c38ee1217a8baa0dd7c37cc85d50138fb0'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/66ea9a7c6824821476914bed21a476cd20094f33'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/73b8e21f76c7dda4905655d2e2c17dc5a73b87f1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/a0fbbd36c156b9f7b2276871d499c9943dfe5101'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00247
epssPercentile: 0.15959
ingestedAt: '2026-10-15T03:30:12.715Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-06-24T15:15:10.639136Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

um: Add winch to winch_handlers before registering winch IRQ

Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.

If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().

Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.

## Affected

- `linux_kernel < 2.6.23`
- `linux_kernel >= 4.19, < 4.19.316`
- `linux_kernel >= 5.4, < 5.4.278`
- `linux_kernel >= 5.10, < 5.10.219`
- `linux_kernel >= 5.15, < 5.15.161`
- `linux_kernel >= 6.1, < 6.1.93`
- `linux_kernel >= 6.6, < 6.6.33`
- `linux_kernel >= 6.9, < 6.9.4`
- `linux_kernel = 6.10.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.4`