GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-43888 (GCVE-0-2024-43888)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:10 – Updated: 2026-08-05 11:36
VLAI
Title
mm: list_lru: fix UAF for memory cgroup
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: list_lru: fix UAF for memory cgroup The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock. Found by code inspection. [songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:31 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0a97c01cd20bb96359d8c9dedad92a061ed34e0b , < 4589f77c18dd98b65f45617b6d1e95313cf6fcab (git)
Affected: 0a97c01cd20bb96359d8c9dedad92a061ed34e0b , < 5161b48712dcd08ec427c450399d4d1483e21dea (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:31:59.160632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:58.783Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4589f77c18dd98b65f45617b6d1e95313cf6fcab",
              "status": "affected",
              "version": "0a97c01cd20bb96359d8c9dedad92a061ed34e0b",
              "versionType": "git"
            },
            {
              "lessThan": "5161b48712dcd08ec427c450399d4d1483e21dea",
              "status": "affected",
              "version": "0a97c01cd20bb96359d8c9dedad92a061ed34e0b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: list_lru: fix UAF for memory cgroup\n\nThe mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or\ncgroup_mutex or others which could prevent returned memcg from being\nfreed.  Fix it by adding missing rcu read lock.\n\nFound by code inspection.\n\n[songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through ordinary filesystem syscalls (open/stat/close/unlink driving d_lru_add/d_lru_del and inode LRU add/del) plus local cgroup manipulation to trigger the memcg teardown. No network peer can drive the memcg-free side of the race, so this requires local system access.\nAC:L - The attacker controls both sides of the race \u2014 one thread rmdirs a cgroup it created to force memcg offline and RCU-deferred free, while another thread loops dentry/inode LRU operations on objects charged to that memcg \u2014 and can retry indefinitely. On CONFIG_PREEMPT and especially PREEMPT_RT kernels (where list_lru_add\u0027s spin_lock is a sleeping rtmutex) the window between reading objcg-\u003ememcg and dereferencing it is readily hit.\nPR:L - Only an unprivileged local account is needed: the LRU paths are hit by unprivileged file operations with no capability check, and cgroup creation/removal is available to normal users via systemd\u0027s delegated user slice or to any container tenant. No real root is required anywhere on the path.\nUI:N - The attacker\u0027s own threads perform every step \u2014 populating a cgroup, tearing it down, and hammering the dentry/inode LRU paths. No victim action is involved.\nS:U - The use-after-free corrupts kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - Reading memcg-\u003ekmemcg_id from freed memory steers list_lru_from_memcg_idx() into another cgroup\u0027s LRU, exposing and cross-linking objects across memcg boundaries, and a groomed reallocation of the freed mem_cgroup gives the attacker control over the pointer chain, which is leverageable for arbitrary kernel memory disclosure.\nI:H - set_shrinker_bit() performs set_bit() through memcg-\u003enodeinfo[nid]-\u003eshrinker_info read from the freed object, so a reallocated and attacker-controlled mem_cgroup turns this into a write primitive at a chosen address; the wrong-index list_add_tail()/list_del_init() also corrupt live list_lru state.\nA:H - A garbage kmemcg_id makes xa_load() return NULL and list_add_tail() dereference it, producing an immediate kernel oops, and the resulting list_lru list corruption and nr_items underflow crash the shrinker later \u2014 a repeatable panic on core dcache/icache paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:59.850Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4589f77c18dd98b65f45617b6d1e95313cf6fcab"
        },
        {
          "url": "https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea"
        }
      ],
      "title": "mm: list_lru: fix UAF for memory cgroup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43888",
    "datePublished": "2024-08-26T10:10:40.890Z",
    "dateReserved": "2024-08-17T09:11:59.288Z",
    "dateUpdated": "2026-08-05T11:36:59.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43888",
      "date": "2026-09-16",
      "epss": "0.00219",
      "percentile": "0.1257"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.10.5\", \"matchCriteriaId\": \"48E239A0-A959-4FAB-8475-D045FED3DDA5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: list_lru: fix UAF for memory cgroup\\n\\nThe mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or\\ncgroup_mutex or others which could prevent returned memcg from being\\nfreed.  Fix it by adding missing rcu read lock.\\n\\nFound by code inspection.\\n\\n[songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]\\n  Link: https://lkml.kernel.org/r/20240801024603.1865-1-songmuchun@bytedance.com\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: list_lru: corrige UAF para memoria cgroup Se supone que mem_cgroup_from_slab_obj() debe llamarse bajo rcu lock o cgroup_mutex u otros, lo que podr\\u00eda impedir que se libere el memcg devuelto. Solucionarlo agregando el bloqueo de lectura rcu que falta. Encontrado mediante inspecci\\u00f3n de c\\u00f3digo. [songmuchun@bytedance.com: solo tome el bloqueo rcu cuando sea necesario, seg\\u00fan Vlastimil] Enlace: https://lkml.kernel.org/r/20240801024603.1865-1-songmuchun@bytedance.com\"}]",
      "id": "CVE-2024-43888",
      "lastModified": "2024-08-27T14:37:52.610",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-26T11:15:03.930",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4589f77c18dd98b65f45617b6d1e95313cf6fcab\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43888\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-26T11:15:03.930\",\"lastModified\":\"2026-08-04T11:19:58.530\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: list_lru: fix UAF for memory cgroup\\n\\nThe mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or\\ncgroup_mutex or others which could prevent returned memcg from being\\nfreed.  Fix it by adding missing rcu read lock.\\n\\nFound by code inspection.\\n\\n[songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: list_lru: corrige UAF para memoria cgroup Se supone que mem_cgroup_from_slab_obj() debe llamarse bajo rcu lock o cgroup_mutex u otros, lo que podr\u00eda impedir que se libere el memcg devuelto. Solucionarlo agregando el bloqueo de lectura rcu que falta. Encontrado mediante inspecci\u00f3n de c\u00f3digo. [songmuchun@bytedance.com: solo tome el bloqueo rcu cuando sea necesario, seg\u00fan Vlastimil] Enlace: https://lkml.kernel.org/r/20240801024603.1865-1-songmuchun@bytedance.com\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/list_lru.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0a97c01cd20bb96359d8c9dedad92a061ed34e0b\",\"lessThan\":\"4589f77c18dd98b65f45617b6d1e95313cf6fcab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a97c01cd20bb96359d8c9dedad92a061ed34e0b\",\"lessThan\":\"5161b48712dcd08ec427c450399d4d1483e21dea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/list_lru.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.5\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:31:59.160632Z\",\"id\":\"CVE-2024-43888\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"48E239A0-A959-4FAB-8475-D045FED3DDA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4589f77c18dd98b65f45617b6d1e95313cf6fcab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:17:56+00:00",
      "cve": "CVE-2024-43888",
      "id": "CVE-2024-43888",
      "initial_release_date": "2024-08-26T00:00:00+00:00",
      "product_status:fixed": "559",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "56",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: list_lru: fix UAF for memory cgroup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43888.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T02:26:49Z",
      "cve": "CVE-2024-43888",
      "id": "CVE-2024-43888",
      "initial_release_date": "2024-08-27T02:24:36Z",
      "product_status:known_not_affected": "372",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43888",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43888.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43888\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:31:59.160632Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.567Z\"}}], \"cna\": {\"title\": \"mm: list_lru: fix UAF for memory cgroup\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0a97c01cd20bb96359d8c9dedad92a061ed34e0b\", \"lessThan\": \"4589f77c18dd98b65f45617b6d1e95313cf6fcab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0a97c01cd20bb96359d8c9dedad92a061ed34e0b\", \"lessThan\": \"5161b48712dcd08ec427c450399d4d1483e21dea\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/list_lru.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/list_lru.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4589f77c18dd98b65f45617b6d1e95313cf6fcab\"}, {\"url\": \"https://git.kernel.org/stable/c/5161b48712dcd08ec427c450399d4d1483e21dea\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: list_lru: fix UAF for memory cgroup\\n\\nThe mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or\\ncgroup_mutex or others which could prevent returned memcg from being\\nfreed.  Fix it by adding missing rcu read lock.\\n\\nFound by code inspection.\\n\\n[songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:31:45.439Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43888\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:31:45.439Z\", \"dateReserved\": \"2024-08-17T09:11:59.288Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:10:40.890Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.