CVE-2024-50036 (GCVE-0-2024-50036)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-05-23 15:54
VLAI
Title
net: do not delay dst_entries_add() in dst_release()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f88649721268999bdff09777847080a52004f691 , < 547087307bc19417b4f2bc85ba9664a3e8db5a6a (git)
Affected: f88649721268999bdff09777847080a52004f691 , < e3915f028b1f1c37e87542e5aadd33728c259d96 (git)
Affected: f88649721268999bdff09777847080a52004f691 , < a60db84f772fc3a906c6c4072f9207579c41166f (git)
Affected: f88649721268999bdff09777847080a52004f691 , < eae7435b48ffc8e9be0ff9cfeae40af479a609dd (git)
Affected: f88649721268999bdff09777847080a52004f691 , < 3c7c918ec0aa3555372c5a57f18780b7a96c5cfc (git)
Affected: f88649721268999bdff09777847080a52004f691 , < ac888d58869bb99753e7652be19a151df9ecb35d (git)
Affected: 86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41 (git)
Affected: 591b1e1bb40152e22cee757f493046a0ca946bf8 (git)
Affected: df90819dafcd6b97fc665f63a15752a570e227a2 (git)
Affected: 9a4fe697023dbe6c25caa1f8b2153af869a29bd2 (git)
Affected: 3.10.50 , < 3.11 (semver)
Affected: 3.12.26 , < 3.13 (semver)
Affected: 3.14.14 , < 3.15 (semver)
Affected: 3.15.7 , < 3.16 (semver)
Create a notification for this product.
Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 5.10.230 , ≤ 5.10.* (semver)
Unaffected: 5.15.172 , ≤ 5.15.* (semver)
Unaffected: 6.1.117 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:25:25.259782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:44.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:42.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "547087307bc19417b4f2bc85ba9664a3e8db5a6a",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "e3915f028b1f1c37e87542e5aadd33728c259d96",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "a60db84f772fc3a906c6c4072f9207579c41166f",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "ac888d58869bb99753e7652be19a151df9ecb35d",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "591b1e1bb40152e22cee757f493046a0ca946bf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df90819dafcd6b97fc665f63a15752a570e227a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9a4fe697023dbe6c25caa1f8b2153af869a29bd2",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.50",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.26",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.14",
              "versionType": "semver"
            },
            {
              "lessThan": "3.16",
              "status": "affected",
              "version": "3.15.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.172",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.15.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n   dst_release_immediate(child), this might also cause UAF\n   if the child does not have DST_NOCOUNT set.\n   IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n   which might happen in future kernels."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:54:16.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d"
        }
      ],
      "title": "net: do not delay dst_entries_add() in dst_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50036",
    "datePublished": "2024-10-21T19:39:37.135Z",
    "dateReserved": "2024-10-21T12:17:06.070Z",
    "dateUpdated": "2026-05-23T15:54:16.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50036",
      "date": "2026-05-25",
      "epss": "0.00019",
      "percentile": "0.0533"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.10.50\", \"versionEndExcluding\": \"3.11\", \"matchCriteriaId\": \"EB008871-978A-402A-8407-15291079DC44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.12.26\", \"versionEndExcluding\": \"3.13\", \"matchCriteriaId\": \"597B9ABF-E2FF-405B-8226-0BD990181032\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.14.14\", \"versionEndExcluding\": \"3.15\", \"matchCriteriaId\": \"6241E34F-0DAB-4BE0-AD33-1BEEDA5841C9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.15.7\", \"versionEndExcluding\": \"3.16\", \"matchCriteriaId\": \"F88CDBE1-4ECE-4BE4-B2A6-7E814D3EA822\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.16\", \"versionEndExcluding\": \"6.6.57\", \"matchCriteriaId\": \"8D4764C3-4502-4F9B-8704-85262723C867\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.4\", \"matchCriteriaId\": \"AA84D336-CE9A-4535-B901-1AD77EC17C34\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not delay dst_entries_add() in dst_release()\\n\\ndst_entries_add() uses per-cpu data that might be freed at netns\\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\\n\\nBefore ip6_route_net_exit() can be called, we release all\\nthe dsts associated with this netns, via calls to dst_release(),\\nwhich waits an rcu grace period before calling dst_destroy()\\n\\ndst_entries_add() use in dst_destroy() is racy, because\\ndst_entries_destroy() could have been called already.\\n\\nDecrementing the number of dsts must happen sooner.\\n\\nNotes:\\n\\n1) in CONFIG_XFRM case, dst_destroy() can call\\n   dst_release_immediate(child), this might also cause UAF\\n   if the child does not have DST_NOCOUNT set.\\n   IPSEC maintainers might take a look and see how to address this.\\n\\n2) There is also discussion about removing this count of dst,\\n   which might happen in future kernels.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no retrasar dst_entries_add() en dst_release() dst_entries_add() usa datos por CPU que podr\\u00edan liberarse en el desmantelamiento de netns de ip6_route_net_exit() llamando a dst_entries_destroy() Antes de que se pueda llamar a ip6_route_net_exit(), liberamos todos los dst asociados con este netns, a trav\\u00e9s de llamadas a dst_release(), que espera un per\\u00edodo de gracia de rcu antes de llamar a dst_destroy() El uso de dst_entries_add() en dst_destroy() es arriesgado, porque dst_entries_destroy() ya podr\\u00eda haberse llamado. La disminuci\\u00f3n del n\\u00famero de dst debe ocurrir antes. Notas: 1) en el caso de CONFIG_XFRM, dst_destroy() puede llamar a dst_release_immediate(child), lo que tambi\\u00e9n podr\\u00eda causar UAF si el hijo no tiene DST_NOCOUNT configurado. Los encargados del mantenimiento de IPSEC podr\\u00edan echar un vistazo y ver c\\u00f3mo solucionar esto. 2) Tambi\\u00e9n se est\\u00e1 discutiendo sobre la eliminaci\\u00f3n de este recuento de dst, lo que podr\\u00eda suceder en kernels futuros.\"}]",
      "id": "CVE-2024-50036",
      "lastModified": "2024-11-17T15:15:18.893",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T20:15:16.717",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50036\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:16.717\",\"lastModified\":\"2025-11-03T23:16:42.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not delay dst_entries_add() in dst_release()\\n\\ndst_entries_add() uses per-cpu data that might be freed at netns\\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\\n\\nBefore ip6_route_net_exit() can be called, we release all\\nthe dsts associated with this netns, via calls to dst_release(),\\nwhich waits an rcu grace period before calling dst_destroy()\\n\\ndst_entries_add() use in dst_destroy() is racy, because\\ndst_entries_destroy() could have been called already.\\n\\nDecrementing the number of dsts must happen sooner.\\n\\nNotes:\\n\\n1) in CONFIG_XFRM case, dst_destroy() can call\\n   dst_release_immediate(child), this might also cause UAF\\n   if the child does not have DST_NOCOUNT set.\\n   IPSEC maintainers might take a look and see how to address this.\\n\\n2) There is also discussion about removing this count of dst,\\n   which might happen in future kernels.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no retrasar dst_entries_add() en dst_release() dst_entries_add() usa datos por CPU que podr\u00edan liberarse en el desmantelamiento de netns de ip6_route_net_exit() llamando a dst_entries_destroy() Antes de que se pueda llamar a ip6_route_net_exit(), liberamos todos los dst asociados con este netns, a trav\u00e9s de llamadas a dst_release(), que espera un per\u00edodo de gracia de rcu antes de llamar a dst_destroy() El uso de dst_entries_add() en dst_destroy() es arriesgado, porque dst_entries_destroy() ya podr\u00eda haberse llamado. La disminuci\u00f3n del n\u00famero de dst debe ocurrir antes. Notas: 1) en el caso de CONFIG_XFRM, dst_destroy() puede llamar a dst_release_immediate(child), lo que tambi\u00e9n podr\u00eda causar UAF si el hijo no tiene DST_NOCOUNT configurado. Los encargados del mantenimiento de IPSEC podr\u00edan echar un vistazo y ver c\u00f3mo solucionar esto. 2) Tambi\u00e9n se est\u00e1 discutiendo sobre la eliminaci\u00f3n de este recuento de dst, lo que podr\u00eda suceder en kernels futuros.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.50\",\"versionEndExcluding\":\"3.11\",\"matchCriteriaId\":\"EB008871-978A-402A-8407-15291079DC44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.26\",\"versionEndExcluding\":\"3.13\",\"matchCriteriaId\":\"597B9ABF-E2FF-405B-8226-0BD990181032\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14.14\",\"versionEndExcluding\":\"3.15\",\"matchCriteriaId\":\"6241E34F-0DAB-4BE0-AD33-1BEEDA5841C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.15.7\",\"versionEndExcluding\":\"3.16\",\"matchCriteriaId\":\"F88CDBE1-4ECE-4BE4-B2A6-7E814D3EA822\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"6.6.57\",\"matchCriteriaId\":\"8D4764C3-4502-4F9B-8704-85262723C867\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"AA84D336-CE9A-4535-B901-1AD77EC17C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:42.427Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50036\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:25:25.259782Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:25:28.324Z\"}}], \"cna\": {\"title\": \"net: do not delay dst_entries_add() in dst_release()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"547087307bc19417b4f2bc85ba9664a3e8db5a6a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"e3915f028b1f1c37e87542e5aadd33728c259d96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"a60db84f772fc3a906c6c4072f9207579c41166f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"eae7435b48ffc8e9be0ff9cfeae40af479a609dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"ac888d58869bb99753e7652be19a151df9ecb35d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"591b1e1bb40152e22cee757f493046a0ca946bf8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"df90819dafcd6b97fc665f63a15752a570e227a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4fe697023dbe6c25caa1f8b2153af869a29bd2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.10.50\", \"lessThan\": \"3.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.12.26\", \"lessThan\": \"3.13\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.14.14\", \"lessThan\": \"3.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.15.7\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/core/dst.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.172\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/dst.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a\"}, {\"url\": \"https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96\"}, {\"url\": \"https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f\"}, {\"url\": \"https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd\"}, {\"url\": \"https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\"}, {\"url\": \"https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not delay dst_entries_add() in dst_release()\\n\\ndst_entries_add() uses per-cpu data that might be freed at netns\\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\\n\\nBefore ip6_route_net_exit() can be called, we release all\\nthe dsts associated with this netns, via calls to dst_release(),\\nwhich waits an rcu grace period before calling dst_destroy()\\n\\ndst_entries_add() use in dst_destroy() is racy, because\\ndst_entries_destroy() could have been called already.\\n\\nDecrementing the number of dsts must happen sooner.\\n\\nNotes:\\n\\n1) in CONFIG_XFRM case, dst_destroy() can call\\n   dst_release_immediate(child), this might also cause UAF\\n   if the child does not have DST_NOCOUNT set.\\n   IPSEC maintainers might take a look and see how to address this.\\n\\n2) There is also discussion about removing this count of dst,\\n   which might happen in future kernels.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.230\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.172\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.117\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.10.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.12.26\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.14.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.15.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:16.288Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50036\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:16.288Z\", \"dateReserved\": \"2024-10-21T12:17:06.070Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:37.135Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.