CVE-2024-50130 (GCVE-0-2024-50130)

Vulnerability from cvelistv5 – Published: 2024-11-05 17:10 – Updated: 2026-08-05 11:41
VLAI
Title
netfilter: bpf: must hold reference on net namespace
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric says: It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpf_nf_link_attach() does : link->net = net; But I do not see a reference being taken on net. Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 84601d6ee68ae820dec97450934797046d62db4b , < f41bd93b3e0508edc7ba820357f949071dcc0acc (git)
Affected: 84601d6ee68ae820dec97450934797046d62db4b , < d0d7939543a1b3bb93af9a18d258a774daf8f162 (git)
Affected: 84601d6ee68ae820dec97450934797046d62db4b , < 1230fe7ad3974f7bf6c78901473e039b34d4fb1f (git)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.59 , ≤ 6.6.* (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T16:08:04.815447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T16:14:33.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f41bd93b3e0508edc7ba820357f949071dcc0acc",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "d0d7939543a1b3bb93af9a18d258a774daf8f162",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            },
            {
              "lessThan": "1230fe7ad3974f7bf6c78901473e039b34d4fb1f",
              "status": "affected",
              "version": "84601d6ee68ae820dec97450934797046d62db4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_bpf_link.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: must hold reference on net namespace\n\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\nbpf_nf_link_release+0xda/0x1e0\nbpf_link_free+0x139/0x2d0\nbpf_link_release+0x68/0x80\n__fput+0x414/0xb60\n\nEric says:\n It seems that bpf was able to defer the __nf_unregister_net_hook()\n after exit()/close() time.\n Perhaps a netns reference is missing, because the netns has been\n dismantled/freed already.\n bpf_nf_link_attach() does :\n link-\u003enet = net;\n But I do not see a reference being taken on net.\n\nAdd such a reference and release it after hook unreg.\nNote that I was unable to get syzbot reproducer to work, so I\ndo not know if this resolves this splat."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is the `bpf(BPF_LINK_CREATE)` syscall combined with `unshare(CLONE_NEWNET)`/`setns()` and `close()` of the link fd, all of which require an executing context on the local machine. No network peer, adjacent-network frame, or physical bus is involved in triggering the dangling `link-\u003enet`.\nAC:L - The attacker performs every step of the sequence themselves \u2014 create the netns, attach the link, drop the last netns reference, wait for `cleanup_net()` to free the `struct net`, then close the fd \u2014 with no race against another party and no unpredictable precondition. Heap grooming of the `net_namespace` cache is done by the attacker\u0027s own repeated namespace creation, and the trigger can be repeated arbitrarily.\nPR:L - Reaching `bpf_nf_link_attach()` needs only `CAP_BPF` plus `CAP_NET_ADMIN` at prog-load time, and `bpf_token_capable()` falls back to `ns_capable(token-\u003euserns, ...)`, so a delegated bpffs BPF token \u2014 the mechanism built expressly for containers \u2014 grants it to an unprivileged user-namespace process; netns creation itself needs only `ns_capable(CAP_SYS_ADMIN)` via `unshare -Ur`. These are non-root, delegable capabilities commonly held by ordinary observability/networking daemons, consistent with kernel CNA precedent for CAP_BPF-gated bugs.\nUI:N - The attacking process creates the namespace, attaches the link, releases the namespace and closes the descriptor entirely within its own context. No victim needs to mount, open, configure, or click anything.\nS:U - The use-after-free occurs in kernel memory and the resulting corruption is confined to the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or VM boundary is crossed.\nC:H - This is a slab use-after-free on `struct net` \u2014 KASAN reports an 8-byte read of freed memory in `__nf_unregister_net_hook()`, and the stale `nf_hook_entries` pointer it yields is then walked and copied by `__nf_hook_entries_try_shrink()` into a fresh allocation. With the freed object reclaimed under attacker-controlled content this becomes a controlled read of arbitrary kernel memory, and it also leaks kernel text/heap addresses of adjacent namespace state.\nI:H - After the freed `struct net` is reallocated, `nf_remove_net_hook()` writes `accept_all` and `\u0026dummy_ops` \u2014 known kernel addresses \u2014 through a pointer and index taken from attacker-groomed memory, and `bpf_nf_disable_defrag()` decrements/zeroes `net-\u003enf.defrag_ipv4_users` in the freed object. That is a write primitive at an attacker-influenced address, sufficient to corrupt another namespace\u0027s netfilter hook table or to build control-flow hijack toward privilege escalation.\nA:H - Even without exploitation the bug is a confirmed KASAN slab-use-after-free that dereferences freed and possibly reused memory in `__nf_unregister_net_hook()`, trips `WARN_ON_ONCE(!p)`/`WARN_ONCE(1, \"hook not found\")`, and readily oopses or panics the kernel. It also leaks the entire `nf_hook_entries` blob of every torn-down namespace, and can be repeated in a loop to reliably crash the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:55.252Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162"
        },
        {
          "url": "https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f"
        }
      ],
      "title": "netfilter: bpf: must hold reference on net namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50130",
    "datePublished": "2024-11-05T17:10:56.344Z",
    "dateReserved": "2024-10-21T19:36:19.955Z",
    "dateUpdated": "2026-08-05T11:41:55.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50130",
      "date": "2026-08-05",
      "epss": "0.00229",
      "percentile": "0.13707"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.4\", \"versionEndExcluding\": \"6.6.59\", \"matchCriteriaId\": \"F0663E1D-0BCE-4D24-BFE4-F9C52687DD40\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.6\", \"matchCriteriaId\": \"E4486B12-007B-4794-9857-F07145637AA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: bpf: must hold reference on net namespace\\n\\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\\nbpf_nf_link_release+0xda/0x1e0\\nbpf_link_free+0x139/0x2d0\\nbpf_link_release+0x68/0x80\\n__fput+0x414/0xb60\\n\\nEric says:\\n It seems that bpf was able to defer the __nf_unregister_net_hook()\\n after exit()/close() time.\\n Perhaps a netns reference is missing, because the netns has been\\n dismantled/freed already.\\n bpf_nf_link_attach() does :\\n link-\u003enet = net;\\n But I do not see a reference being taken on net.\\n\\nAdd such a reference and release it after hook unreg.\\nNote that I was unable to get syzbot reproducer to work, so I\\ndo not know if this resolves this splat.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: bpf: debe contener referencia en el espacio de nombres net ERROR: KASAN: slab-use-after-free en __nf_unregister_net_hook+0x640/0x6b0 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff8880106fe400 por la tarea repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric dice: Parece que bpf pudo diferir __nf_unregister_net_hook() despu\\u00e9s del tiempo de exit()/close(). Quiz\\u00e1s falta una referencia a netns, porque netns ya se ha desmantelado/liberado. bpf_nf_link_attach() hace: link-\u0026gt;net = net; Pero no veo que se tome ninguna referencia en net. Agregue dicha referencia y lib\\u00e9rela despu\\u00e9s de anular el registro. Tenga en cuenta que no pude hacer que funcionara el reproductor syzbot, por lo que no s\\u00e9 si esto resuelve este problema.\"}]",
      "id": "CVE-2024-50130",
      "lastModified": "2024-11-07T21:49:00.380",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-11-05T18:15:15.850",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:10:30.000Z",
      "cve": "CVE-2024-50130",
      "id": "msrc_CVE-2024-50130",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: bpf: must hold reference on net namespace",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50130.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50130\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-05T18:15:15.850\",\"lastModified\":\"2026-06-17T08:03:40.080\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: bpf: must hold reference on net namespace\\n\\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\\nbpf_nf_link_release+0xda/0x1e0\\nbpf_link_free+0x139/0x2d0\\nbpf_link_release+0x68/0x80\\n__fput+0x414/0xb60\\n\\nEric says:\\n It seems that bpf was able to defer the __nf_unregister_net_hook()\\n after exit()/close() time.\\n Perhaps a netns reference is missing, because the netns has been\\n dismantled/freed already.\\n bpf_nf_link_attach() does :\\n link-\u003enet = net;\\n But I do not see a reference being taken on net.\\n\\nAdd such a reference and release it after hook unreg.\\nNote that I was unable to get syzbot reproducer to work, so I\\ndo not know if this resolves this splat.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: bpf: debe contener referencia en el espacio de nombres net ERROR: KASAN: slab-use-after-free en __nf_unregister_net_hook+0x640/0x6b0 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8880106fe400 por la tarea repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric dice: Parece que bpf pudo diferir __nf_unregister_net_hook() despu\u00e9s del tiempo de exit()/close(). Quiz\u00e1s falta una referencia a netns, porque netns ya se ha desmantelado/liberado. bpf_nf_link_attach() hace: link-\u0026gt;net = net; Pero no veo que se tome ninguna referencia en net. Agregue dicha referencia y lib\u00e9rela despu\u00e9s de anular el registro. Tenga en cuenta que no pude hacer que funcionara el reproductor syzbot, por lo que no s\u00e9 si esto resuelve este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_bpf_link.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"84601d6ee68ae820dec97450934797046d62db4b\",\"lessThan\":\"f41bd93b3e0508edc7ba820357f949071dcc0acc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84601d6ee68ae820dec97450934797046d62db4b\",\"lessThan\":\"d0d7939543a1b3bb93af9a18d258a774daf8f162\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84601d6ee68ae820dec97450934797046d62db4b\",\"lessThan\":\"1230fe7ad3974f7bf6c78901473e039b34d4fb1f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_bpf_link.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.59\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-06T16:08:04.815447Z\",\"id\":\"CVE-2024-50130\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.59\",\"matchCriteriaId\":\"F0663E1D-0BCE-4D24-BFE4-F9C52687DD40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"E4486B12-007B-4794-9857-F07145637AA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T08:08:48+00:00",
      "cve": "CVE-2024-50130",
      "id": "CVE-2024-50130",
      "initial_release_date": "2024-11-05T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: bpf: must hold reference on net namespace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50130.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:28:00Z",
      "cve": "CVE-2024-50130",
      "id": "CVE-2024-50130",
      "initial_release_date": "2024-11-06T03:48:43Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "364",
      "product_status:recommended": "412",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50130",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50130.json",
      "version": "62"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50130\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-06T16:08:04.815447Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-06T16:08:06.703Z\"}}], \"cna\": {\"title\": \"netfilter: bpf: must hold reference on net namespace\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"f41bd93b3e0508edc7ba820357f949071dcc0acc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"d0d7939543a1b3bb93af9a18d258a774daf8f162\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84601d6ee68ae820dec97450934797046d62db4b\", \"lessThan\": \"1230fe7ad3974f7bf6c78901473e039b34d4fb1f\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/nf_bpf_link.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_bpf_link.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f41bd93b3e0508edc7ba820357f949071dcc0acc\"}, {\"url\": \"https://git.kernel.org/stable/c/d0d7939543a1b3bb93af9a18d258a774daf8f162\"}, {\"url\": \"https://git.kernel.org/stable/c/1230fe7ad3974f7bf6c78901473e039b34d4fb1f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: bpf: must hold reference on net namespace\\n\\nBUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0\\nRead of size 8 at addr ffff8880106fe400 by task repro/72=\\nbpf_nf_link_release+0xda/0x1e0\\nbpf_link_free+0x139/0x2d0\\nbpf_link_release+0x68/0x80\\n__fput+0x414/0xb60\\n\\nEric says:\\n It seems that bpf was able to defer the __nf_unregister_net_hook()\\n after exit()/close() time.\\n Perhaps a netns reference is missing, because the netns has been\\n dismantled/freed already.\\n bpf_nf_link_attach() does :\\n link-\u003enet = net;\\n But I do not see a reference being taken on net.\\n\\nAdd such a reference and release it after hook unreg.\\nNote that I was unable to get syzbot reproducer to work, so I\\ndo not know if this resolves this splat.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:46:49.610Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50130\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:46:49.610Z\", \"dateReserved\": \"2024-10-21T19:36:19.955Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-05T17:10:56.344Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.