GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36972 (GCVE-0-2024-36972)

Vulnerability from cvelistv5 – Published: 2024-06-10 14:57 – Updated: 2026-08-05 11:32
VLAI
Title
af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set NULL to it locklessly. However, the peer socket still can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading NULL pointer dereference. [0] To fix the issue, let's update unix_sk(sk)->oob_skb under the sk_receive_queue's lock and take it everywhere we touch oob_skb. Note that we defer kfree_skb() in manage_oob() to silence lockdep false-positive (See [1]). [0]: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events delayed_fput RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847) Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00 R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> unix_release_sock (net/unix/af_unix.c:654) unix_release (net/unix/af_unix.c:1050) __sock_release (net/socket.c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) delayed_fput (fs/file_table.c:444 (discriminator 3)) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:257) </TASK> Modules linked in: CR2: 0000000000000008
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-05 03:56 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4fe505c63aa3273135a57597fda761e9aecc7668 , < 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 (git)
Affected: e0e09186d8821ad59806115d347ea32efa43ca4b , < 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1 (git)
Affected: b74aa9ce13d02b7fd37c5325b99854f91b9b4276 , < d59ae9314b97e01c76a4171472441e55721ba636 (git)
Affected: 1279f9d9dec2d7462823a18c29ad61359e0a007d , < 4708f49add84a57ce0ccc7bf9a6269845c631cc3 (git)
Affected: 1279f9d9dec2d7462823a18c29ad61359e0a007d , < 9841991a446c87f90f66f4b9fee6fe934c1336a2 (git)
Affected: 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140 (git)
Affected: 5.15.149 , < 5.15.161 (semver)
Affected: 6.1.78 , < 6.1.93 (semver)
Affected: 6.6.17 , < 6.6.33 (semver)
Affected: 6.7.5 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.9.4 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: 4fe505c63aa3 , < 518a994aa0b8 (git)
Affected: e0e09186d882 , < 4bf6964451c3 (git)
Affected: b74aa9ce13d0 , < d59ae9314b97 (custom)
Affected: 1279f9d9dec2 , < 4708f49add84 (custom)
Affected: 1279f9d9dec2 , < 9841991a446c (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Affected: 6.8
    cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "518a994aa0b8",
                "status": "affected",
                "version": "4fe505c63aa3",
                "versionType": "git"
              },
              {
                "lessThan": "4bf6964451c3",
                "status": "affected",
                "version": "e0e09186d882",
                "versionType": "git"
              },
              {
                "lessThan": "d59ae9314b97",
                "status": "affected",
                "version": "b74aa9ce13d0",
                "versionType": "custom"
              },
              {
                "lessThan": "4708f49add84",
                "status": "affected",
                "version": "1279f9d9dec2",
                "versionType": "custom"
              },
              {
                "lessThan": "9841991a446c",
                "status": "affected",
                "version": "1279f9d9dec2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.8"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36972",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T03:56:02.065864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T15:34:54.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "518a994aa0b87d96f1bc6678a7035df5d1fcd7a1",
              "status": "affected",
              "version": "4fe505c63aa3273135a57597fda761e9aecc7668",
              "versionType": "git"
            },
            {
              "lessThan": "4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1",
              "status": "affected",
              "version": "e0e09186d8821ad59806115d347ea32efa43ca4b",
              "versionType": "git"
            },
            {
              "lessThan": "d59ae9314b97e01c76a4171472441e55721ba636",
              "status": "affected",
              "version": "b74aa9ce13d02b7fd37c5325b99854f91b9b4276",
              "versionType": "git"
            },
            {
              "lessThan": "4708f49add84a57ce0ccc7bf9a6269845c631cc3",
              "status": "affected",
              "version": "1279f9d9dec2d7462823a18c29ad61359e0a007d",
              "versionType": "git"
            },
            {
              "lessThan": "9841991a446c87f90f66f4b9fee6fe934c1336a2",
              "status": "affected",
              "version": "1279f9d9dec2d7462823a18c29ad61359e0a007d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "82ae47c5c3a6b27fdc0f9e83c1499cb439c56140",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.161",
              "status": "affected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.93",
              "status": "affected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.33",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.15.149",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "6.1.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.\n\nBilly Jheng Bing-Jhong reported a race between __unix_gc() and\nqueue_oob().\n\n__unix_gc() tries to garbage-collect close()d inflight sockets,\nand then if the socket has MSG_OOB in unix_sk(sk)-\u003eoob_skb, GC\nwill drop the reference and set NULL to it locklessly.\n\nHowever, the peer socket still can send MSG_OOB message and\nqueue_oob() can update unix_sk(sk)-\u003eoob_skb concurrently, leading\nNULL pointer dereference. [0]\n\nTo fix the issue, let\u0027s update unix_sk(sk)-\u003eoob_skb under the\nsk_receive_queue\u0027s lock and take it everywhere we touch oob_skb.\n\nNote that we defer kfree_skb() in manage_oob() to silence lockdep\nfalse-positive (See [1]).\n\n[0]:\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n PF: supervisor write access in kernel mode\n PF: error_code(0x0002) - not-present page\nPGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0\nOops: 0002 [#1] PREEMPT SMP PTI\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: events delayed_fput\nRIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)\nCode: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 \u003c48\u003e 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc\nRSP: 0018:ffffc900001bfd48 EFLAGS: 00000002\nRAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9\nRDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00\nRBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001\nR10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00\nR13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80\nFS:  0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n unix_release_sock (net/unix/af_unix.c:654)\n unix_release (net/unix/af_unix.c:1050)\n __sock_release (net/socket.c:660)\n sock_close (net/socket.c:1423)\n __fput (fs/file_table.c:423)\n delayed_fput (fs/file_table.c:444 (discriminator 3))\n process_one_work (kernel/workqueue.c:3259)\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)\n kthread (kernel/kthread.c:388)\n ret_from_fork (arch/x86/kernel/process.c:153)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:257)\n \u003c/TASK\u003e\nModules linked in:\nCR2: 0000000000000008"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - AF_UNIX is local-only IPC; the race is driven from `sendmsg(MSG_OOB)` and `close()` syscalls on socketpairs, with no network-facing entry point.\nAC:L - The attacker controls both sides of the race \u2014 it queues MSG_OOB in a loop on one CPU while forcing `unix_gc()` on another by closing sockets with inflight SCM_RIGHTS cycles, and can retry indefinitely until the window is hit.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, send MSG_OOB and SCM_RIGHTS, and close descriptors; no capabilities, namespaces, or non-default configuration are required (CONFIG_AF_UNIX_OOB is default y).\nUI:N - The attacker performs every step itself from its own processes/threads; no victim action or cooperating peer is needed since a socketpair is self-owned.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The double-free leaves a freed sk_buff linked in `sk_receive_queue`; reclaiming it with sprayed data lets the attacker control `skb-\u003edata`/`skb-\u003elen` and read arbitrary kernel memory via subsequent recvmsg.\nI:H - A use-after-free/double-free of an sk_buff yields write primitives (list unlink writes and attacker-controlled skb fields on reclaimed slab objects), which is exploitable for privilege escalation.\nA:H - The reported symptom is a kernel oops (supervisor write fault in `skb_dequeue` from `unix_release_sock`), and freed-object list corruption reliably panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:23.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636"
        },
        {
          "url": "https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2"
        }
      ],
      "title": "af_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36972",
    "datePublished": "2024-06-10T14:57:42.271Z",
    "dateReserved": "2024-05-30T15:25:07.082Z",
    "dateUpdated": "2026-08-05T11:32:23.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36972",
      "date": "2026-09-16",
      "epss": "0.00521",
      "percentile": "0.4295"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.\\n\\nBilly Jheng Bing-Jhong reported a race between __unix_gc() and\\nqueue_oob().\\n\\n__unix_gc() tries to garbage-collect close()d inflight sockets,\\nand then if the socket has MSG_OOB in unix_sk(sk)-\u003eoob_skb, GC\\nwill drop the reference and set NULL to it locklessly.\\n\\nHowever, the peer socket still can send MSG_OOB message and\\nqueue_oob() can update unix_sk(sk)-\u003eoob_skb concurrently, leading\\nNULL pointer dereference. [0]\\n\\nTo fix the issue, let\u0027s update unix_sk(sk)-\u003eoob_skb under the\\nsk_receive_queue\u0027s lock and take it everywhere we touch oob_skb.\\n\\nNote that we defer kfree_skb() in manage_oob() to silence lockdep\\nfalse-positive (See [1]).\\n\\n[0]:\\nBUG: kernel NULL pointer dereference, address: 0000000000000008\\n PF: supervisor write access in kernel mode\\n PF: error_code(0x0002) - not-present page\\nPGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0\\nOops: 0002 [#1] PREEMPT SMP PTI\\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\\nWorkqueue: events delayed_fput\\nRIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)\\nCode: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 \u003c48\u003e 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc\\nRSP: 0018:ffffc900001bfd48 EFLAGS: 00000002\\nRAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9\\nRDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00\\nRBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001\\nR10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00\\nR13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80\\nFS:  0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n unix_release_sock (net/unix/af_unix.c:654)\\n unix_release (net/unix/af_unix.c:1050)\\n __sock_release (net/socket.c:660)\\n sock_close (net/socket.c:1423)\\n __fput (fs/file_table.c:423)\\n delayed_fput (fs/file_table.c:444 (discriminator 3))\\n process_one_work (kernel/workqueue.c:3259)\\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)\\n kthread (kernel/kthread.c:388)\\n ret_from_fork (arch/x86/kernel/process.c:153)\\n ret_from_fork_asm (arch/x86/entry/entry_64.S:257)\\n \u003c/TASK\u003e\\nModules linked in:\\nCR2: 0000000000000008\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_unix: actualice unix_sk(sk)-\u0026gt;oob_skb bajo el bloqueo sk_receive_queue. Billy Jheng Bing-Jhong inform\\u00f3 de una ejecuci\\u00f3n entre __unix_gc() y queue_oob(). __unix_gc() intenta recolectar basura de sockets en vuelo close()d, y luego, si el socket tiene MSG_OOB en unix_sk(sk)-\u0026gt;oob_skb, GC eliminar\\u00e1 la referencia y establecer\\u00e1 NULL sin bloqueo. Sin embargo, el socket del par a\\u00fan puede enviar el mensaje MSG_OOB y queue_oob() puede actualizar unix_sk(sk)-\u0026gt;oob_skb simult\\u00e1neamente, lo que lleva a la desreferencia del puntero NULL. [0] Para solucionar el problema, actualicemos unix_sk(sk)-\u0026gt;oob_skb bajo el bloqueo de sk_receive_queue y lo llevemos a todos los lugares donde toquemos oob_skb. Tenga en cuenta que posponemos kfree_skb() en Manage_oob() para silenciar el falso positivo de Lockdep (consulte [1]). [0]: ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 0000000000000008 PF: acceso de escritura del supervisor en modo kernel PF: error_code(0x0002) - p\\u00e1gina no presente PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 Ups: 02 [#1] SMP ADELANTADO PTI CPU: 3 PID: 50 Comm: kworker/3:1 No contaminado 6.9.0-rc5-00191-gd091e579b864 #110 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0- gd239552ce722-prebuilt.qemu.org 01/04/2014 Cola de trabajo: eventos retrasados_fput RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff. c:3847) C\\u00f3digo: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 0 00 00 \u0026lt;48 \u0026gt; 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 RAX: 0000000000000000 RBX: 80088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000003 R11: 00000000000000001 R12: ffff8880056b6a00 R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 : 0000000080050033 CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 PKRU: 55555554 Seguimiento de llamadas:  unix_release_sock (net/unix/af_unix.c:654) ix_release (net/unix/af_unix.c:1050) __sock_release (net/socket. c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) retrasado_fput (fs/file_table.c:444 (discriminador 3)) Process_one_work (kernel/workqueue.c:3259) trabajador_thread ( kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S :257)  M\\u00f3dulos vinculados en: CR2: 0000000000000008\"}]",
      "id": "CVE-2024-36972",
      "lastModified": "2024-11-21T09:22:56.643",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.9}]}",
      "published": "2024-06-10T15:15:52.617",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:42:20.000Z",
      "cve": "CVE-2024-36972",
      "id": "msrc_CVE-2024-36972",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "af_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36972.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36972\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-10T15:15:52.617\",\"lastModified\":\"2026-08-04T11:18:36.757\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.\\n\\nBilly Jheng Bing-Jhong reported a race between __unix_gc() and\\nqueue_oob().\\n\\n__unix_gc() tries to garbage-collect close()d inflight sockets,\\nand then if the socket has MSG_OOB in unix_sk(sk)-\u003eoob_skb, GC\\nwill drop the reference and set NULL to it locklessly.\\n\\nHowever, the peer socket still can send MSG_OOB message and\\nqueue_oob() can update unix_sk(sk)-\u003eoob_skb concurrently, leading\\nNULL pointer dereference. [0]\\n\\nTo fix the issue, let\u0027s update unix_sk(sk)-\u003eoob_skb under the\\nsk_receive_queue\u0027s lock and take it everywhere we touch oob_skb.\\n\\nNote that we defer kfree_skb() in manage_oob() to silence lockdep\\nfalse-positive (See [1]).\\n\\n[0]:\\nBUG: kernel NULL pointer dereference, address: 0000000000000008\\n PF: supervisor write access in kernel mode\\n PF: error_code(0x0002) - not-present page\\nPGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0\\nOops: 0002 [#1] PREEMPT SMP PTI\\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\\nWorkqueue: events delayed_fput\\nRIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)\\nCode: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 \u003c48\u003e 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc\\nRSP: 0018:ffffc900001bfd48 EFLAGS: 00000002\\nRAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9\\nRDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00\\nRBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001\\nR10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00\\nR13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80\\nFS:  0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n unix_release_sock (net/unix/af_unix.c:654)\\n unix_release (net/unix/af_unix.c:1050)\\n __sock_release (net/socket.c:660)\\n sock_close (net/socket.c:1423)\\n __fput (fs/file_table.c:423)\\n delayed_fput (fs/file_table.c:444 (discriminator 3))\\n process_one_work (kernel/workqueue.c:3259)\\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)\\n kthread (kernel/kthread.c:388)\\n ret_from_fork (arch/x86/kernel/process.c:153)\\n ret_from_fork_asm (arch/x86/entry/entry_64.S:257)\\n \u003c/TASK\u003e\\nModules linked in:\\nCR2: 0000000000000008\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_unix: actualice unix_sk(sk)-\u0026gt;oob_skb bajo el bloqueo sk_receive_queue. Billy Jheng Bing-Jhong inform\u00f3 de una ejecuci\u00f3n entre __unix_gc() y queue_oob(). __unix_gc() intenta recolectar basura de sockets en vuelo close()d, y luego, si el socket tiene MSG_OOB en unix_sk(sk)-\u0026gt;oob_skb, GC eliminar\u00e1 la referencia y establecer\u00e1 NULL sin bloqueo. Sin embargo, el socket del par a\u00fan puede enviar el mensaje MSG_OOB y queue_oob() puede actualizar unix_sk(sk)-\u0026gt;oob_skb simult\u00e1neamente, lo que lleva a la desreferencia del puntero NULL. [0] Para solucionar el problema, actualicemos unix_sk(sk)-\u0026gt;oob_skb bajo el bloqueo de sk_receive_queue y lo llevemos a todos los lugares donde toquemos oob_skb. Tenga en cuenta que posponemos kfree_skb() en Manage_oob() para silenciar el falso positivo de Lockdep (consulte [1]). [0]: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000008 PF: acceso de escritura del supervisor en modo kernel PF: error_code(0x0002) - p\u00e1gina no presente PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 Ups: 02 [#1] SMP ADELANTADO PTI CPU: 3 PID: 50 Comm: kworker/3:1 No contaminado 6.9.0-rc5-00191-gd091e579b864 #110 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0- gd239552ce722-prebuilt.qemu.org 01/04/2014 Cola de trabajo: eventos retrasados_fput RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff. c:3847) C\u00f3digo: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 0 00 00 \u0026lt;48 \u0026gt; 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 RAX: 0000000000000000 RBX: 80088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000003 R11: 00000000000000001 R12: ffff8880056b6a00 R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 : 0000000080050033 CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 PKRU: 55555554 Seguimiento de llamadas:  unix_release_sock (net/unix/af_unix.c:654) ix_release (net/unix/af_unix.c:1050) __sock_release (net/socket. c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) retrasado_fput (fs/file_table.c:444 (discriminador 3)) Process_one_work (kernel/workqueue.c:3259) trabajador_thread ( kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S :257)  M\u00f3dulos vinculados en: CR2: 0000000000000008\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4fe505c63aa3273135a57597fda761e9aecc7668\",\"lessThan\":\"518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0e09186d8821ad59806115d347ea32efa43ca4b\",\"lessThan\":\"4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b74aa9ce13d02b7fd37c5325b99854f91b9b4276\",\"lessThan\":\"d59ae9314b97e01c76a4171472441e55721ba636\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1279f9d9dec2d7462823a18c29ad61359e0a007d\",\"lessThan\":\"4708f49add84a57ce0ccc7bf9a6269845c631cc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1279f9d9dec2d7462823a18c29ad61359e0a007d\",\"lessThan\":\"9841991a446c87f90f66f4b9fee6fe934c1336a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"82ae47c5c3a6b27fdc0f9e83c1499cb439c56140\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.149\",\"lessThan\":\"5.15.161\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.78\",\"lessThan\":\"6.1.93\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.17\",\"lessThan\":\"6.6.33\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.5\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.4\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"4fe505c63aa3\",\"lessThan\":\"518a994aa0b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0e09186d882\",\"lessThan\":\"4bf6964451c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b74aa9ce13d0\",\"lessThan\":\"d59ae9314b97\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1279f9d9dec2\",\"lessThan\":\"4708f49add84\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1279f9d9dec2\",\"lessThan\":\"9841991a446c\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-05T03:56:02.065864Z\",\"id\":\"CVE-2024-36972\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.149\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"B352E704-FEF8-4BA0-9064-0310CA037F76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.78\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"1CB8B30F-8348-4301-9CC0-BAC96389E8FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.17\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"AD0395CE-7CC6-456D-8D56-AD099301D02C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.5\",\"versionEndExcluding\":\"6.9.4\",\"matchCriteriaId\":\"9DDC3C50-22E5-4037-AF83-67F18752FCA2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:42:59+00:00",
      "cve": "CVE-2024-36972",
      "id": "CVE-2024-36972",
      "initial_release_date": "2024-06-10T00:00:00+00:00",
      "product_status:known_affected": "120",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36972.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T02:34:47Z",
      "cve": "CVE-2024-36972",
      "id": "CVE-2024-36972",
      "initial_release_date": "2024-06-11T02:05:27Z",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "354",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36972",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36972.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.584Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36972\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-05T03:56:02.065864Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4fe505c63aa3\", \"lessThan\": \"518a994aa0b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e0e09186d882\", \"lessThan\": \"4bf6964451c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b74aa9ce13d0\", \"lessThan\": \"d59ae9314b97\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1279f9d9dec2\", \"lessThan\": \"4708f49add84\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1279f9d9dec2\", \"lessThan\": \"9841991a446c\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}], \"defaultStatus\": \"affected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T16:56:02.136Z\"}}], \"cna\": {\"title\": \"af_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - AF_UNIX is local-only IPC; the race is driven from `sendmsg(MSG_OOB)` and `close()` syscalls on socketpairs, with no network-facing entry point.\\nAC:L - The attacker controls both sides of the race \\u2014 it queues MSG_OOB in a loop on one CPU while forcing `unix_gc()` on another by closing sockets with inflight SCM_RIGHTS cycles, and can retry indefinitely until the window is hit.\\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, send MSG_OOB and SCM_RIGHTS, and close descriptors; no capabilities, namespaces, or non-default configuration are required (CONFIG_AF_UNIX_OOB is default y).\\nUI:N - The attacker performs every step itself from its own processes/threads; no victim action or cooperating peer is needed since a socketpair is self-owned.\\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The double-free leaves a freed sk_buff linked in `sk_receive_queue`; reclaiming it with sprayed data lets the attacker control `skb-\u003edata`/`skb-\u003elen` and read arbitrary kernel memory via subsequent recvmsg.\\nI:H - A use-after-free/double-free of an sk_buff yields write primitives (list unlink writes and attacker-controlled skb fields on reclaimed slab objects), which is exploitable for privilege escalation.\\nA:H - The reported symptom is a kernel oops (supervisor write fault in `skb_dequeue` from `unix_release_sock`), and freed-object list corruption reliably panics the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4fe505c63aa3273135a57597fda761e9aecc7668\", \"lessThan\": \"518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e0e09186d8821ad59806115d347ea32efa43ca4b\", \"lessThan\": \"4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b74aa9ce13d02b7fd37c5325b99854f91b9b4276\", \"lessThan\": \"d59ae9314b97e01c76a4171472441e55721ba636\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1279f9d9dec2d7462823a18c29ad61359e0a007d\", \"lessThan\": \"4708f49add84a57ce0ccc7bf9a6269845c631cc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1279f9d9dec2d7462823a18c29ad61359e0a007d\", \"lessThan\": \"9841991a446c87f90f66f4b9fee6fe934c1336a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"82ae47c5c3a6b27fdc0f9e83c1499cb439c56140\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.149\", \"lessThan\": \"5.15.161\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.78\", \"lessThan\": \"6.1.93\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.17\", \"lessThan\": \"6.6.33\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.5\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/unix/af_unix.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/unix/af_unix.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1\"}, {\"url\": \"https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1\"}, {\"url\": \"https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636\"}, {\"url\": \"https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3\"}, {\"url\": \"https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Update unix_sk(sk)-\u003eoob_skb under sk_receive_queue lock.\\n\\nBilly Jheng Bing-Jhong reported a race between __unix_gc() and\\nqueue_oob().\\n\\n__unix_gc() tries to garbage-collect close()d inflight sockets,\\nand then if the socket has MSG_OOB in unix_sk(sk)-\u003eoob_skb, GC\\nwill drop the reference and set NULL to it locklessly.\\n\\nHowever, the peer socket still can send MSG_OOB message and\\nqueue_oob() can update unix_sk(sk)-\u003eoob_skb concurrently, leading\\nNULL pointer dereference. [0]\\n\\nTo fix the issue, let\u0027s update unix_sk(sk)-\u003eoob_skb under the\\nsk_receive_queue\u0027s lock and take it everywhere we touch oob_skb.\\n\\nNote that we defer kfree_skb() in manage_oob() to silence lockdep\\nfalse-positive (See [1]).\\n\\n[0]:\\nBUG: kernel NULL pointer dereference, address: 0000000000000008\\n PF: supervisor write access in kernel mode\\n PF: error_code(0x0002) - not-present page\\nPGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0\\nOops: 0002 [#1] PREEMPT SMP PTI\\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\\nWorkqueue: events delayed_fput\\nRIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)\\nCode: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 \u003c48\u003e 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc\\nRSP: 0018:ffffc900001bfd48 EFLAGS: 00000002\\nRAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9\\nRDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00\\nRBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001\\nR10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00\\nR13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80\\nFS:  0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n unix_release_sock (net/unix/af_unix.c:654)\\n unix_release (net/unix/af_unix.c:1050)\\n __sock_release (net/socket.c:660)\\n sock_close (net/socket.c:1423)\\n __fput (fs/file_table.c:423)\\n delayed_fput (fs/file_table.c:444 (discriminator 3))\\n process_one_work (kernel/workqueue.c:3259)\\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)\\n kthread (kernel/kthread.c:388)\\n ret_from_fork (arch/x86/kernel/process.c:153)\\n ret_from_fork_asm (arch/x86/entry/entry_64.S:257)\\n \u003c/TASK\u003e\\nModules linked in:\\nCR2: 0000000000000008\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.15.149\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"6.1.78\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"6.6.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.4\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.7.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:23.250Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36972\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:23.250Z\", \"dateReserved\": \"2024-05-30T15:25:07.082Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-10T14:57:42.271Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.