GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36009 (GCVE-0-2024-36009)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:48 – Updated: 2026-08-05 11:31
VLAI
Title
ax25: Fix netdev refcount issue
Summary
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix netdev refcount issue The dev_tracker is added to ax25_cb in ax25_bind(). When the ax25 device is detaching, the dev_tracker of ax25_cb should be deallocated in ax25_kill_by_device() instead of the dev_tracker of ax25_dev. The log reported by ref_tracker is shown below: [ 80.884935] ref_tracker: reference already released. [ 80.885150] ref_tracker: allocated in: [ 80.885349] ax25_dev_device_up+0x105/0x540 [ 80.885730] ax25_device_event+0xa4/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.885730] ref_tracker: freed in: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] dev_close_many+0x272/0x370 [ 80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 [ 80.885730] unregister_netdev+0xcf/0x120 [ 80.885730] sixpack_close+0x11f/0x1b0 [ 80.885730] tty_ldisc_kill+0xcb/0x190 [ 80.885730] tty_ldisc_hangup+0x338/0x3d0 [ 80.885730] __tty_hangup+0x504/0x740 [ 80.885730] tty_release+0x46e/0xd80 [ 80.885730] __fput+0x37f/0x770 [ 80.885730] __x64_sys_close+0x7b/0xb0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.893739] ------------[ cut here ]------------ [ 80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0 [ 80.894297] Modules linked in: [ 80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11 [ 80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 [ 80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0 [ 80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 [ 80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286 [ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 [ 80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518 [ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a [ 80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4 [ 80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 [ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 [ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0 ... [ 80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at [ 80.935774] ax25_bind+0x424/0x4e0 [ 80.935774] __sys_bind+0x1d9/0x270 [ 80.935774] __x64_sys_bind+0x75/0x80 [ 80.935774] do_syscall_64+0xc4/0x1b0 [ 80.935774] entry_SYSCALL_64_after_hwframe+0x67/0x6f Change ax25_dev->dev_tracker to the dev_tracker of ax25_cb in order to mitigate the bug.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 20:06 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: feef318c855a361a1eccd880f33e88c460eb63b4 , < 0d14f104027e30720582448706c7d6b43065c851 (git)
Affected: feef318c855a361a1eccd880f33e88c460eb63b4 , < 4fee8fa86a15d7790268eea458b1aec69c695530 (git)
Affected: feef318c855a361a1eccd880f33e88c460eb63b4 , < c42b073d9af4a5329b25b17390c63ab3847f30e8 (git)
Affected: feef318c855a361a1eccd880f33e88c460eb63b4 , < 467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b (git)
Affected: b8c07f33aa35dacf5444e7053ed9662d1869f536 (git)
Affected: b1e0a6fc7f17500484c402ad1cd018c24dfc14b3 (git)
Affected: 7528d0f2210c3a1154186175516ed37aa970f2b1 (git)
Affected: 57cc15f5fd550316e4104eaf84b90fbc640fd7a5 (git)
Affected: b982492ec3a115e0a136856a1b2dbe32f2d21a0e (git)
Affected: 4.14.277 , < 4.15 (semver)
Affected: 4.19.240 , < 4.20 (semver)
Affected: 5.4.190 , < 5.5 (semver)
Affected: 5.10.112 , < 5.11 (semver)
Affected: 5.15.35 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.90 , ≤ 6.1.* (semver)
Unaffected: 6.6.30 , ≤ 6.6.* (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36009",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T20:06:19.404612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-13T20:06:29.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d14f104027e30720582448706c7d6b43065c851",
              "status": "affected",
              "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
              "versionType": "git"
            },
            {
              "lessThan": "4fee8fa86a15d7790268eea458b1aec69c695530",
              "status": "affected",
              "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
              "versionType": "git"
            },
            {
              "lessThan": "c42b073d9af4a5329b25b17390c63ab3847f30e8",
              "status": "affected",
              "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
              "versionType": "git"
            },
            {
              "lessThan": "467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b",
              "status": "affected",
              "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8c07f33aa35dacf5444e7053ed9662d1869f536",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1e0a6fc7f17500484c402ad1cd018c24dfc14b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7528d0f2210c3a1154186175516ed37aa970f2b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "57cc15f5fd550316e4104eaf84b90fbc640fd7a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b982492ec3a115e0a136856a1b2dbe32f2d21a0e",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.277",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.240",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.35",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ax25/af_ax25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.90",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.277",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix netdev refcount issue\n\nThe dev_tracker is added to ax25_cb in ax25_bind(). When the\nax25 device is detaching, the dev_tracker of ax25_cb should be\ndeallocated in ax25_kill_by_device() instead of the dev_tracker\nof ax25_dev. The log reported by ref_tracker is shown below:\n\n[   80.884935] ref_tracker: reference already released.\n[   80.885150] ref_tracker: allocated in:\n[   80.885349]  ax25_dev_device_up+0x105/0x540\n[   80.885730]  ax25_device_event+0xa4/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  __dev_notify_flags+0x138/0x280\n[   80.885730]  dev_change_flags+0xd7/0x180\n[   80.885730]  dev_ifsioc+0x6a9/0xa30\n[   80.885730]  dev_ioctl+0x4d8/0xd90\n[   80.885730]  sock_do_ioctl+0x1c2/0x2d0\n[   80.885730]  sock_ioctl+0x38b/0x4f0\n[   80.885730]  __se_sys_ioctl+0xad/0xf0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.885730] ref_tracker: freed in:\n[   80.885730]  ax25_device_event+0x272/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  dev_close_many+0x272/0x370\n[   80.885730]  unregister_netdevice_many_notify+0x3b5/0x1180\n[   80.885730]  unregister_netdev+0xcf/0x120\n[   80.885730]  sixpack_close+0x11f/0x1b0\n[   80.885730]  tty_ldisc_kill+0xcb/0x190\n[   80.885730]  tty_ldisc_hangup+0x338/0x3d0\n[   80.885730]  __tty_hangup+0x504/0x740\n[   80.885730]  tty_release+0x46e/0xd80\n[   80.885730]  __fput+0x37f/0x770\n[   80.885730]  __x64_sys_close+0x7b/0xb0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.893739] ------------[ cut here ]------------\n[   80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0\n[   80.894297] Modules linked in:\n[   80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11\n[   80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4\n[   80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0\n[   80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9\n[   80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286\n[   80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000\n[   80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518\n[   80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a\n[   80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4\n[   80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518\n[   80.898279] FS:  00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000\n[   80.899436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0\n...\n[   80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at\n[   80.935774]      ax25_bind+0x424/0x4e0\n[   80.935774]      __sys_bind+0x1d9/0x270\n[   80.935774]      __x64_sys_bind+0x75/0x80\n[   80.935774]      do_syscall_64+0xc4/0x1b0\n[   80.935774]      entry_SYSCALL_64_after_hwframe+0x67/0x6f\n\nChange ax25_dev-\u003edev_tracker to the dev_tracker of ax25_cb\nin order to mitigate the bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local syscalls \u2014 socket()/bind() on AF_AX25 plus the netdev down/unregister notifier \u2014 and AX.25 sockets and devices are restricted to the initial network namespace, so no remote or adjacent packet path reaches this code.\nAC:L - Within an affected configuration the erroneous tracker release is deterministic: any socket bound to the AX.25 device makes ax25_kill_by_device() free the wrong tracker, and the subsequent ax25_dev_device_down() double-free is unconditional. The heap-recycling escalation is driven by attacker-controlled AX.25 bind/close churn on both sides, so no condition outside the attacker\u0027s influence is required.\nPR:L - An ordinary unprivileged local user can create and bind an AX.25 socket (ax25_create requires no capability for SOCK_SEQPACKET/SOCK_DGRAM and ax25_bind only checks CAP_NET_ADMIN when the non-default ax25_uid_policy is set), and that bound socket is the precondition that makes the buggy netdev_put() execute.\nUI:N - No victim action is needed for the exploit itself \u2014 the trigger is the interface going down or the KISS/6pack TNC detaching, which happens as routine operation of an AX.25 station rather than as a deliberate user action on the attacker\u0027s behalf.\nS:U - The mismanaged reference tracking, the WARN, and any resulting memory corruption all occur inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale ax25_dev-\u003edev_tracker pointer is dereferenced after the tracker object is recycled out of the 128-entry quarantine, giving a read of freed/reused slab memory whose contents the attacker can groom, which is an arbitrary-read style disclosure primitive; the WARN/ref_tracker splats additionally dump kernel addresses and stack traces.\nI:H - After the tracker is freed, ref_tracker_free() writes tracker-\u003efree_stack_handle and performs list_move_tail() on the reused object, yielding a list-unlink write with attacker-influenced pointers \u2014 memory corruption exploitable for control-flow hijacking.\nA:H - The bug reliably produces a WARNING at lib/ref_tracker.c:255 (a panic on panic_on_warn systems) plus a second WARN for leaked trackers at netdev teardown, and the freed-object path causes kernel oopses/heap corruption; the unreleased ax25_cb trackers also leak memory for the netdev\u0027s lifetime."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:33.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
        },
        {
          "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
        }
      ],
      "title": "ax25: Fix netdev refcount issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36009",
    "datePublished": "2024-05-20T09:48:08.238Z",
    "dateReserved": "2024-05-17T13:50:33.152Z",
    "dateUpdated": "2026-08-05T11:31:33.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36009",
      "date": "2026-09-19",
      "epss": "0.00233",
      "percentile": "0.14506"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix netdev refcount issue\n\nThe dev_tracker is added to ax25_cb in ax25_bind(). When the\nax25 device is detaching, the dev_tracker of ax25_cb should be\ndeallocated in ax25_kill_by_device() instead of the dev_tracker\nof ax25_dev. The log reported by ref_tracker is shown below:\n\n[   80.884935] ref_tracker: reference already released.\n[   80.885150] ref_tracker: allocated in:\n[   80.885349]  ax25_dev_device_up+0x105/0x540\n[   80.885730]  ax25_device_event+0xa4/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  __dev_notify_flags+0x138/0x280\n[   80.885730]  dev_change_flags+0xd7/0x180\n[   80.885730]  dev_ifsioc+0x6a9/0xa30\n[   80.885730]  dev_ioctl+0x4d8/0xd90\n[   80.885730]  sock_do_ioctl+0x1c2/0x2d0\n[   80.885730]  sock_ioctl+0x38b/0x4f0\n[   80.885730]  __se_sys_ioctl+0xad/0xf0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.885730] ref_tracker: freed in:\n[   80.885730]  ax25_device_event+0x272/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  dev_close_many+0x272/0x370\n[   80.885730]  unregister_netdevice_many_notify+0x3b5/0x1180\n[   80.885730]  unregister_netdev+0xcf/0x120\n[   80.885730]  sixpack_close+0x11f/0x1b0\n[   80.885730]  tty_ldisc_kill+0xcb/0x190\n[   80.885730]  tty_ldisc_hangup+0x338/0x3d0\n[   80.885730]  __tty_hangup+0x504/0x740\n[   80.885730]  tty_release+0x46e/0xd80\n[   80.885730]  __fput+0x37f/0x770\n[   80.885730]  __x64_sys_close+0x7b/0xb0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.893739] ------------[ cut here ]------------\n[   80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0\n[   80.894297] Modules linked in:\n[   80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11\n[   80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4\n[   80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0\n[   80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9\n[   80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286\n[   80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000\n[   80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518\n[   80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a\n[   80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4\n[   80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518\n[   80.898279] FS:  00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000\n[   80.899436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0\n...\n[   80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at\n[   80.935774]      ax25_bind+0x424/0x4e0\n[   80.935774]      __sys_bind+0x1d9/0x270\n[   80.935774]      __x64_sys_bind+0x75/0x80\n[   80.935774]      do_syscall_64+0xc4/0x1b0\n[   80.935774]      entry_SYSCALL_64_after_hwframe+0x67/0x6f\n\nChange ax25_dev-\u003edev_tracker to the dev_tracker of ax25_cb\nin order to mitigate the bug."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ax25: soluciona el problema de recuento de netdev. El dev_tracker se agrega a ax25_cb en ax25_bind(). Cuando el dispositivo ax25 se est\u00e1 desconectando, el dev_tracker de ax25_cb debe desasignarse en ax25_kill_by_device() en lugar del dev_tracker de ax25_dev. El registro informado por ref_tracker se muestra a continuaci\u00f3n: [80.884935] ref_tracker: referencia ya publicada. [80.885150] ref_tracker: asignado en: [80.885349] ax25_dev_device_up+0x105/0x540 [80.885730] ax25_device_event+0xa4/0x420 [80.885730] notifier_call_chain+0xc9/0x1e0 [80. 885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730 ] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] Entry_SYSCALL_64_after_hwframe +0x67/0x6f [ 80.885730] ref_tracker: liberado en: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] 370 [80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 [80.885730] unregister_netdev+0xcf /0x120 [ 80.885730] sixpack_close+0x11f/0x1b0 [ 80.885730] tty_ldisc_kill+0xcb/0x190 [ 80.885730] tty_ldisc_hangup+0x338/0x3d0 [ 80.885730] x740 [ 80.885730] tty_release+0x46e/0xd80 [ 80.885730] __fput+0x37f/0x770 [80.885730] __x64_sys_close+0x7b/0xb0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] Entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.893739] ------------[ cortar aqu\u00ed ]--- ---- ----- [80.894030] ADVERTENCIA: CPU: 2 PID: 140 en lib/ref_tracker.c: 255 ref_tracker_free+0x47b/0x6b0 [80.894297] M\u00f3dulos vinculados en: [80.894929] CPU: 2 pid: 140 Comm: ax25_conn_rel 6 no Tainted 6.9.0-rc4-g8cd26fd90c1a #11 [80.895190] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 [80.895514] RIP:ref_tracker_free +0x47b /0x6b0 [ 80.895808] C\u00f3digo: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 [ 80.896171] 0018:ffff888009edf8c0 EFLAGS: 00000286 [ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 [ 80.896502] RDX: 00000000000000001 RSI: 0000000000000246 RDI: ff88800a0d6518 [ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a [ 80.897212] R10: dffffc0000000000 R11: 1b R12: ffff88800a4a31d4 [ 80.897859 ] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 [ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) 000000000000000 [ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.900181] CR2: 00007fd88c001d48 CR3 : 000000000993e000 CR4: 00000000000006f0 ... [ 80.935774] ref_tracker: sp%d@000000000bb9df3d tiene 1/1 usuarios en [ 80.935774] ax25_bind+0x424/0x4e0 [ 80.93577 4] __sys_bind+0x1d9/0x270 [ 80.935774] __x64_sys_bind+0x75/0x80 [ 80.935774 ] do_syscall_64+0xc4/0x1b0 [ 80.935774] Entry_SYSCALL_64_after_hwframe+0x67/0x6f Cambie ax25_dev-\u0026gt;dev_tracker al dev_tracker de ax25_cb para mitigar el error."
        }
      ],
      "id": "CVE-2024-36009",
      "lastModified": "2024-11-21T09:21:25.517",
      "published": "2024-05-20T10:15:14.773",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:09:53.000Z",
      "cve": "CVE-2024-36009",
      "id": "msrc_CVE-2024-36009",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ax25: Fix netdev refcount issue",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36009.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ax25/af_ax25.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0d14f104027e30720582448706c7d6b43065c851",
                    "status": "affected",
                    "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fee8fa86a15d7790268eea458b1aec69c695530",
                    "status": "affected",
                    "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c42b073d9af4a5329b25b17390c63ab3847f30e8",
                    "status": "affected",
                    "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b",
                    "status": "affected",
                    "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b8c07f33aa35dacf5444e7053ed9662d1869f536",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b1e0a6fc7f17500484c402ad1cd018c24dfc14b3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7528d0f2210c3a1154186175516ed37aa970f2b1",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "57cc15f5fd550316e4104eaf84b90fbc640fd7a5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b982492ec3a115e0a136856a1b2dbe32f2d21a0e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.277",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.240",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.35",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ax25/af_ax25.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.90",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26F3B000-E328-48CE-9B1E-68E0DFD0A909",
                    "versionEndExcluding": "4.15",
                    "versionStartIncluding": "4.14.277",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36C10971-E218-4588-B691-A4A3534A3B58",
                    "versionEndExcluding": "4.20",
                    "versionStartIncluding": "4.19.240",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38031C07-F0BC-442A-A08F-FB9B732F2CA5",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.190",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E1C7F59E-6FCD-4163-9D36-1585FB5A71E7",
                    "versionEndExcluding": "5.11",
                    "versionStartIncluding": "5.10.112",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5DFF4167-1962-4F68-81DD-C3D56FE88E76",
                    "versionEndExcluding": "5.16",
                    "versionStartIncluding": "5.15.35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "969CEDFE-6B61-459E-BE63-1DA9B8416267",
                    "versionEndExcluding": "6.1.90",
                    "versionStartIncluding": "5.17.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84046DAF-73CF-429D-9BA4-05B658B377B5",
                    "versionEndExcluding": "6.6.30",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612",
                    "versionEndExcluding": "6.8.9",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A59F7FD3-F505-48BD-8875-F07A33F42F6C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "B2D2677C-5389-4AE9-869D-0F881E80D923",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "EFA3917C-C322-4D92-912D-ECE45B2E7416",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "BED18363-5ABC-4639-8BBA-68E771E5BB3F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "7F635F96-FA0A-4769-ADE8-232B3AC9116D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "FD39FE73-2A9D-4C92-AE7A-CA22F84B228D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix netdev refcount issue\n\nThe dev_tracker is added to ax25_cb in ax25_bind(). When the\nax25 device is detaching, the dev_tracker of ax25_cb should be\ndeallocated in ax25_kill_by_device() instead of the dev_tracker\nof ax25_dev. The log reported by ref_tracker is shown below:\n\n[   80.884935] ref_tracker: reference already released.\n[   80.885150] ref_tracker: allocated in:\n[   80.885349]  ax25_dev_device_up+0x105/0x540\n[   80.885730]  ax25_device_event+0xa4/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  __dev_notify_flags+0x138/0x280\n[   80.885730]  dev_change_flags+0xd7/0x180\n[   80.885730]  dev_ifsioc+0x6a9/0xa30\n[   80.885730]  dev_ioctl+0x4d8/0xd90\n[   80.885730]  sock_do_ioctl+0x1c2/0x2d0\n[   80.885730]  sock_ioctl+0x38b/0x4f0\n[   80.885730]  __se_sys_ioctl+0xad/0xf0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.885730] ref_tracker: freed in:\n[   80.885730]  ax25_device_event+0x272/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  dev_close_many+0x272/0x370\n[   80.885730]  unregister_netdevice_many_notify+0x3b5/0x1180\n[   80.885730]  unregister_netdev+0xcf/0x120\n[   80.885730]  sixpack_close+0x11f/0x1b0\n[   80.885730]  tty_ldisc_kill+0xcb/0x190\n[   80.885730]  tty_ldisc_hangup+0x338/0x3d0\n[   80.885730]  __tty_hangup+0x504/0x740\n[   80.885730]  tty_release+0x46e/0xd80\n[   80.885730]  __fput+0x37f/0x770\n[   80.885730]  __x64_sys_close+0x7b/0xb0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.893739] ------------[ cut here ]------------\n[   80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0\n[   80.894297] Modules linked in:\n[   80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11\n[   80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4\n[   80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0\n[   80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9\n[   80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286\n[   80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000\n[   80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518\n[   80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a\n[   80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4\n[   80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518\n[   80.898279] FS:  00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000\n[   80.899436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0\n...\n[   80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at\n[   80.935774]      ax25_bind+0x424/0x4e0\n[   80.935774]      __sys_bind+0x1d9/0x270\n[   80.935774]      __x64_sys_bind+0x75/0x80\n[   80.935774]      do_syscall_64+0xc4/0x1b0\n[   80.935774]      entry_SYSCALL_64_after_hwframe+0x67/0x6f\n\nChange ax25_dev-\u003edev_tracker to the dev_tracker of ax25_cb\nin order to mitigate the bug."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ax25: soluciona el problema de recuento de netdev. El dev_tracker se agrega a ax25_cb en ax25_bind(). Cuando el dispositivo ax25 se est\u00e1 desconectando, el dev_tracker de ax25_cb debe desasignarse en ax25_kill_by_device() en lugar del dev_tracker de ax25_dev. El registro informado por ref_tracker se muestra a continuaci\u00f3n: [80.884935] ref_tracker: referencia ya publicada. [80.885150] ref_tracker: asignado en: [80.885349] ax25_dev_device_up+0x105/0x540 [80.885730] ax25_device_event+0xa4/0x420 [80.885730] notifier_call_chain+0xc9/0x1e0 [80. 885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730 ] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] Entry_SYSCALL_64_after_hwframe +0x67/0x6f [ 80.885730] ref_tracker: liberado en: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] 370 [80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 [80.885730] unregister_netdev+0xcf /0x120 [ 80.885730] sixpack_close+0x11f/0x1b0 [ 80.885730] tty_ldisc_kill+0xcb/0x190 [ 80.885730] tty_ldisc_hangup+0x338/0x3d0 [ 80.885730] x740 [ 80.885730] tty_release+0x46e/0xd80 [ 80.885730] __fput+0x37f/0x770 [80.885730] __x64_sys_close+0x7b/0xb0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] Entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.893739] ------------[ cortar aqu\u00ed ]--- ---- ----- [80.894030] ADVERTENCIA: CPU: 2 PID: 140 en lib/ref_tracker.c: 255 ref_tracker_free+0x47b/0x6b0 [80.894297] M\u00f3dulos vinculados en: [80.894929] CPU: 2 pid: 140 Comm: ax25_conn_rel 6 no Tainted 6.9.0-rc4-g8cd26fd90c1a #11 [80.895190] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 [80.895514] RIP:ref_tracker_free +0x47b /0x6b0 [ 80.895808] C\u00f3digo: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 [ 80.896171] 0018:ffff888009edf8c0 EFLAGS: 00000286 [ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 [ 80.896502] RDX: 00000000000000001 RSI: 0000000000000246 RDI: ff88800a0d6518 [ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a [ 80.897212] R10: dffffc0000000000 R11: 1b R12: ffff88800a4a31d4 [ 80.897859 ] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 [ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) 000000000000000 [ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.900181] CR2: 00007fd88c001d48 CR3 : 000000000993e000 CR4: 00000000000006f0 ... [ 80.935774] ref_tracker: sp%d@000000000bb9df3d tiene 1/1 usuarios en [ 80.935774] ax25_bind+0x424/0x4e0 [ 80.93577 4] __sys_bind+0x1d9/0x270 [ 80.935774] __x64_sys_bind+0x75/0x80 [ 80.935774 ] do_syscall_64+0xc4/0x1b0 [ 80.935774] Entry_SYSCALL_64_after_hwframe+0x67/0x6f Cambie ax25_dev-\u0026gt;dev_tracker al dev_tracker de ax25_cb para mitigar el error."
          }
        ],
        "id": "CVE-2024-36009",
        "lastModified": "2026-08-04T11:18:21.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-36009",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T20:06:19.404612Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-20T10:15:14.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:27+00:00",
      "cve": "CVE-2024-36009",
      "id": "CVE-2024-36009",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ax25: Fix netdev refcount issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36009.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:36:25Z",
      "cve": "CVE-2024-36009",
      "id": "CVE-2024-36009",
      "initial_release_date": "2024-05-21T01:58:09Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "257",
      "product_status:recommended": "645",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36009",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36009.json",
      "version": "117"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:30:12.796Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-36009",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-13T20:06:19.404612Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-13T20:06:25.401Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/ax25/af_ax25.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "0d14f104027e30720582448706c7d6b43065c851",
                  "status": "affected",
                  "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                  "versionType": "git"
                },
                {
                  "lessThan": "4fee8fa86a15d7790268eea458b1aec69c695530",
                  "status": "affected",
                  "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                  "versionType": "git"
                },
                {
                  "lessThan": "c42b073d9af4a5329b25b17390c63ab3847f30e8",
                  "status": "affected",
                  "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                  "versionType": "git"
                },
                {
                  "lessThan": "467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b",
                  "status": "affected",
                  "version": "feef318c855a361a1eccd880f33e88c460eb63b4",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "b8c07f33aa35dacf5444e7053ed9662d1869f536",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "b1e0a6fc7f17500484c402ad1cd018c24dfc14b3",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "7528d0f2210c3a1154186175516ed37aa970f2b1",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "57cc15f5fd550316e4104eaf84b90fbc640fd7a5",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "b982492ec3a115e0a136856a1b2dbe32f2d21a0e",
                  "versionType": "git"
                },
                {
                  "lessThan": "4.15",
                  "status": "affected",
                  "version": "4.14.277",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.20",
                  "status": "affected",
                  "version": "4.19.240",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.5",
                  "status": "affected",
                  "version": "5.4.190",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.11",
                  "status": "affected",
                  "version": "5.10.112",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.16",
                  "status": "affected",
                  "version": "5.15.35",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/ax25/af_ax25.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.17"
                },
                {
                  "lessThan": "5.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.90",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.30",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.90",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.30",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.9",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "4.14.277",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "4.19.240",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.4.190",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.10.112",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.15.35",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Fix netdev refcount issue\n\nThe dev_tracker is added to ax25_cb in ax25_bind(). When the\nax25 device is detaching, the dev_tracker of ax25_cb should be\ndeallocated in ax25_kill_by_device() instead of the dev_tracker\nof ax25_dev. The log reported by ref_tracker is shown below:\n\n[   80.884935] ref_tracker: reference already released.\n[   80.885150] ref_tracker: allocated in:\n[   80.885349]  ax25_dev_device_up+0x105/0x540\n[   80.885730]  ax25_device_event+0xa4/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  __dev_notify_flags+0x138/0x280\n[   80.885730]  dev_change_flags+0xd7/0x180\n[   80.885730]  dev_ifsioc+0x6a9/0xa30\n[   80.885730]  dev_ioctl+0x4d8/0xd90\n[   80.885730]  sock_do_ioctl+0x1c2/0x2d0\n[   80.885730]  sock_ioctl+0x38b/0x4f0\n[   80.885730]  __se_sys_ioctl+0xad/0xf0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.885730] ref_tracker: freed in:\n[   80.885730]  ax25_device_event+0x272/0x420\n[   80.885730]  notifier_call_chain+0xc9/0x1e0\n[   80.885730]  dev_close_many+0x272/0x370\n[   80.885730]  unregister_netdevice_many_notify+0x3b5/0x1180\n[   80.885730]  unregister_netdev+0xcf/0x120\n[   80.885730]  sixpack_close+0x11f/0x1b0\n[   80.885730]  tty_ldisc_kill+0xcb/0x190\n[   80.885730]  tty_ldisc_hangup+0x338/0x3d0\n[   80.885730]  __tty_hangup+0x504/0x740\n[   80.885730]  tty_release+0x46e/0xd80\n[   80.885730]  __fput+0x37f/0x770\n[   80.885730]  __x64_sys_close+0x7b/0xb0\n[   80.885730]  do_syscall_64+0xc4/0x1b0\n[   80.885730]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   80.893739] ------------[ cut here ]------------\n[   80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0\n[   80.894297] Modules linked in:\n[   80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11\n[   80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4\n[   80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0\n[   80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9\n[   80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286\n[   80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000\n[   80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518\n[   80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a\n[   80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4\n[   80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518\n[   80.898279] FS:  00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000\n[   80.899436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0\n...\n[   80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at\n[   80.935774]      ax25_bind+0x424/0x4e0\n[   80.935774]      __sys_bind+0x1d9/0x270\n[   80.935774]      __x64_sys_bind+0x75/0x80\n[   80.935774]      do_syscall_64+0xc4/0x1b0\n[   80.935774]      entry_SYSCALL_64_after_hwframe+0x67/0x6f\n\nChange ax25_dev-\u003edev_tracker to the dev_tracker of ax25_cb\nin order to mitigate the bug."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable path is reached through local syscalls \u2014 socket()/bind() on AF_AX25 plus the netdev down/unregister notifier \u2014 and AX.25 sockets and devices are restricted to the initial network namespace, so no remote or adjacent packet path reaches this code.\nAC:L - Within an affected configuration the erroneous tracker release is deterministic: any socket bound to the AX.25 device makes ax25_kill_by_device() free the wrong tracker, and the subsequent ax25_dev_device_down() double-free is unconditional. The heap-recycling escalation is driven by attacker-controlled AX.25 bind/close churn on both sides, so no condition outside the attacker\u0027s influence is required.\nPR:L - An ordinary unprivileged local user can create and bind an AX.25 socket (ax25_create requires no capability for SOCK_SEQPACKET/SOCK_DGRAM and ax25_bind only checks CAP_NET_ADMIN when the non-default ax25_uid_policy is set), and that bound socket is the precondition that makes the buggy netdev_put() execute.\nUI:N - No victim action is needed for the exploit itself \u2014 the trigger is the interface going down or the KISS/6pack TNC detaching, which happens as routine operation of an AX.25 station rather than as a deliberate user action on the attacker\u0027s behalf.\nS:U - The mismanaged reference tracking, the WARN, and any resulting memory corruption all occur inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale ax25_dev-\u003edev_tracker pointer is dereferenced after the tracker object is recycled out of the 128-entry quarantine, giving a read of freed/reused slab memory whose contents the attacker can groom, which is an arbitrary-read style disclosure primitive; the WARN/ref_tracker splats additionally dump kernel addresses and stack traces.\nI:H - After the tracker is freed, ref_tracker_free() writes tracker-\u003efree_stack_handle and performs list_move_tail() on the reused object, yielding a list-unlink write with attacker-influenced pointers \u2014 memory corruption exploitable for control-flow hijacking.\nA:H - The bug reliably produces a WARNING at lib/ref_tracker.c:255 (a panic on panic_on_warn systems) plus a second WARN for leaked trackers at netdev teardown, and the freed-object path causes kernel oopses/heap corruption; the unreleased ax25_cb trackers also leak memory for the netdev\u0027s lifetime."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:31:33.867Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/0d14f104027e30720582448706c7d6b43065c851"
            },
            {
              "url": "https://git.kernel.org/stable/c/4fee8fa86a15d7790268eea458b1aec69c695530"
            },
            {
              "url": "https://git.kernel.org/stable/c/c42b073d9af4a5329b25b17390c63ab3847f30e8"
            },
            {
              "url": "https://git.kernel.org/stable/c/467324bcfe1a31ec65d0cf4aa59421d6b7a7d52b"
            }
          ],
          "title": "ax25: Fix netdev refcount issue",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-36009",
        "datePublished": "2024-05-20T09:48:08.238Z",
        "dateReserved": "2024-05-17T13:50:33.152Z",
        "dateUpdated": "2026-08-05T11:31:33.867Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.