GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50028 (GCVE-0-2024-50028)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
Title
thermal: core: Reference count the zone in thermal_zone_get_by_id()
Summary
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Reference count the zone in thermal_zone_get_by_id() There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00 , < c95538b286efc6109c987e97a051bc7844ede802 (git)
Affected: 1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00 , < a42a5839f400e929c489bb1b58f54596c4535167 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:26:28.280587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:46.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c",
            "drivers/thermal/thermal_core.h",
            "drivers/thermal/thermal_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c95538b286efc6109c987e97a051bc7844ede802",
              "status": "affected",
              "version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
              "versionType": "git"
            },
            {
              "lessThan": "a42a5839f400e929c489bb1b58f54596c4535167",
              "status": "affected",
              "version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c",
            "drivers/thermal/thermal_core.h",
            "drivers/thermal/thermal_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable handlers are reached through the thermal generic-netlink family via a local AF_NETLINK socket, not from any remote peer. Per kernel scoring guidance, netlink-reachable code is Local.\nAC:L - The attacker fully controls and can continuously repeat the read side (unlimited TZ_GET_TEMP/TRIP/GOV requests from many threads), and the free side leaves a very wide window (list_del under thermal_list_lock, then cancel_delayed_work_sync, device_del and wait_for_completion before kfree), so a zone teardown from any routine event (driver/module removal, device hot-unplug, power-supply/charger removal, CPU hotplug or suspend/resume) is reliably won; the stale pointer can also be held across preemption.\nPR:L - The thermal genl ops carry no GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flag, so genl_family_rcv_msg() applies no capability check \u2014 any unprivileged local user can open NETLINK_GENERIC and issue these commands with an arbitrary zone id.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink requests plus a concurrent zone teardown; no victim action is needed at any point.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Contents of the freed thermal_zone_device are copied directly back to the attacker in the netlink reply \u2014 trip temperatures/types, the governor name via a stale tz-\u003egovernor pointer dereference, and a trip loop bounded by num_trips read from freed memory, giving an effectively unbounded heap read primitive after reclaim.\nI:H - The handlers write into the freed object (mutex_lock on tz-\u003elock) and, in the GET_TEMP path, make an indirect call through tz-\u003eops.get_temp read out of freed slab memory, which after a heap spray yields attacker-controlled control-flow hijack and arbitrary kernel modification.\nA:H - Even unweaponized, dereferencing and locking the freed thermal zone (and calling a stale ops pointer) causes memory corruption and kernel oops/panic, repeatable at will by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:04.376Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802"
        },
        {
          "url": "https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"
        }
      ],
      "title": "thermal: core: Reference count the zone in thermal_zone_get_by_id()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50028",
    "datePublished": "2024-10-21T19:39:31.809Z",
    "dateReserved": "2024-10-21T12:17:06.066Z",
    "dateUpdated": "2026-08-05T11:41:04.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50028",
      "date": "2026-09-15",
      "epss": "0.00215",
      "percentile": "0.12022"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9\", \"versionEndExcluding\": \"6.11.4\", \"matchCriteriaId\": \"E7C7402D-CBDE-4B07-833D-4B8DC6E5C230\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\\n\\nThere are places in the thermal netlink code where nothing prevents\\nthe thermal zone object from going away while being accessed after it\\nhas been returned by thermal_zone_get_by_id().\\n\\nTo address this, make thermal_zone_get_by_id() get a reference on the\\nthermal zone device object to be returned with the help of get_device(),\\nunder thermal_list_lock, and adjust all of its callers to this change\\nwith the help of the cleanup.h infrastructure.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: recuento de referencia de la zona en thermal_zone_get_by_id() Hay lugares en el c\\u00f3digo de netlink t\\u00e9rmico donde nada impide que el objeto de zona t\\u00e9rmica desaparezca mientras se accede a \\u00e9l despu\\u00e9s de que thermal_zone_get_by_id() lo haya devuelto. Para solucionar esto, haga que thermal_zone_get_by_id() obtenga una referencia en el objeto de dispositivo de zona t\\u00e9rmica que se devolver\\u00e1 con la ayuda de get_device(), bajo thermal_list_lock, y ajuste todos sus llamadores a este cambio con la ayuda de la infraestructura cleanup.h.\"}]",
      "id": "CVE-2024-50028",
      "lastModified": "2024-10-25T15:21:23.237",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:16.163",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:51:07.000Z",
      "cve": "CVE-2024-50028",
      "id": "msrc_CVE-2024-50028",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:under_investigation": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "thermal: core: Reference count the zone in thermal_zone_get_by_id()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50028.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50028\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:16.163\",\"lastModified\":\"2026-08-04T11:21:08.930\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\\n\\nThere are places in the thermal netlink code where nothing prevents\\nthe thermal zone object from going away while being accessed after it\\nhas been returned by thermal_zone_get_by_id().\\n\\nTo address this, make thermal_zone_get_by_id() get a reference on the\\nthermal zone device object to be returned with the help of get_device(),\\nunder thermal_list_lock, and adjust all of its callers to this change\\nwith the help of the cleanup.h infrastructure.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: recuento de referencia de la zona en thermal_zone_get_by_id() Hay lugares en el c\u00f3digo de netlink t\u00e9rmico donde nada impide que el objeto de zona t\u00e9rmica desaparezca mientras se accede a \u00e9l despu\u00e9s de que thermal_zone_get_by_id() lo haya devuelto. Para solucionar esto, haga que thermal_zone_get_by_id() obtenga una referencia en el objeto de dispositivo de zona t\u00e9rmica que se devolver\u00e1 con la ayuda de get_device(), bajo thermal_list_lock, y ajuste todos sus llamadores a este cambio con la ayuda de la infraestructura cleanup.h.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/thermal/thermal_core.c\",\"drivers/thermal/thermal_core.h\",\"drivers/thermal/thermal_netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00\",\"lessThan\":\"c95538b286efc6109c987e97a051bc7844ede802\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00\",\"lessThan\":\"a42a5839f400e929c489bb1b58f54596c4535167\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/thermal/thermal_core.c\",\"drivers/thermal/thermal_core.h\",\"drivers/thermal/thermal_netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.4\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:26:28.280587Z\",\"id\":\"CVE-2024-50028\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"E7C7402D-CBDE-4B07-833D-4B8DC6E5C230\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T15:47:24+00:00",
      "cve": "CVE-2024-50028",
      "id": "CVE-2024-50028",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50028.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:19:51Z",
      "cve": "CVE-2024-50028",
      "id": "CVE-2024-50028",
      "initial_release_date": "2024-10-22T02:50:15Z",
      "product_status:known_affected": "432",
      "product_status:known_not_affected": "328",
      "product_status:recommended": "681",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50028",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50028.json",
      "version": "70"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50028\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:26:28.280587Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:26:31.893Z\"}}], \"cna\": {\"title\": \"thermal: core: Reference count the zone in thermal_zone_get_by_id()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable handlers are reached through the thermal generic-netlink family via a local AF_NETLINK socket, not from any remote peer. Per kernel scoring guidance, netlink-reachable code is Local.\\nAC:L - The attacker fully controls and can continuously repeat the read side (unlimited TZ_GET_TEMP/TRIP/GOV requests from many threads), and the free side leaves a very wide window (list_del under thermal_list_lock, then cancel_delayed_work_sync, device_del and wait_for_completion before kfree), so a zone teardown from any routine event (driver/module removal, device hot-unplug, power-supply/charger removal, CPU hotplug or suspend/resume) is reliably won; the stale pointer can also be held across preemption.\\nPR:L - The thermal genl ops carry no GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flag, so genl_family_rcv_msg() applies no capability check \\u2014 any unprivileged local user can open NETLINK_GENERIC and issue these commands with an arbitrary zone id.\\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink requests plus a concurrent zone teardown; no victim action is needed at any point.\\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - Contents of the freed thermal_zone_device are copied directly back to the attacker in the netlink reply \\u2014 trip temperatures/types, the governor name via a stale tz-\u003egovernor pointer dereference, and a trip loop bounded by num_trips read from freed memory, giving an effectively unbounded heap read primitive after reclaim.\\nI:H - The handlers write into the freed object (mutex_lock on tz-\u003elock) and, in the GET_TEMP path, make an indirect call through tz-\u003eops.get_temp read out of freed slab memory, which after a heap spray yields attacker-controlled control-flow hijack and arbitrary kernel modification.\\nA:H - Even unweaponized, dereferencing and locking the freed thermal zone (and calling a stale ops pointer) causes memory corruption and kernel oops/panic, repeatable at will by an unprivileged process.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00\", \"lessThan\": \"c95538b286efc6109c987e97a051bc7844ede802\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00\", \"lessThan\": \"a42a5839f400e929c489bb1b58f54596c4535167\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/thermal/thermal_core.c\", \"drivers/thermal/thermal_core.h\", \"drivers/thermal/thermal_netlink.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/thermal/thermal_core.c\", \"drivers/thermal/thermal_core.h\", \"drivers/thermal/thermal_netlink.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802\"}, {\"url\": \"https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\\n\\nThere are places in the thermal netlink code where nothing prevents\\nthe thermal zone object from going away while being accessed after it\\nhas been returned by thermal_zone_get_by_id().\\n\\nTo address this, make thermal_zone_get_by_id() get a reference on the\\nthermal zone device object to be returned with the help of get_device(),\\nunder thermal_list_lock, and adjust all of its callers to this change\\nwith the help of the cleanup.h infrastructure.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:41:04.376Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50028\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:41:04.376Z\", \"dateReserved\": \"2024-10-21T12:17:06.066Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:31.809Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.