Vulnerability-Lookup

RHSA-2024_5257

Vulnerability from csaf_redhat - Published: 2024-08-13 10:08 - Updated: 2024-11-24 17:19

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: KVM: s390: vsie: fix race during shadow creation (CVE-2023-52639) * kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (CVE-2024-26808) * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898) * kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978) * kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CVE-2021-47624) * kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090) * kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091) * kernel: KEV - Beaky Buzzard (CVE-2024-36971) Bug Fix(es): * updating nvme firmware, '# nvme list' output does not reflect the new firmware version without rebooting. (JIRA:RHEL-46809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-47624

A memory leak flaw was found in the Linux kernel’s SunRpc filesystem (sysfs). This flaw allows a local user to crash the system.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 210 products

Product	Version	Remediation
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-abi-stablelists-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-aarch64-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-ppc64le-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-s390x-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-x86_64-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-doc-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-abi-stablelists-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-aarch64-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-ppc64le-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-s390x-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-x86_64-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-doc-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround

Known not affected 8 products

Product	Version	Remediation
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.aarch64	—	Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.ppc64le	—	Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.s390x	—	Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.x86_64	—	Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.aarch64	—	Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.ppc64le	—	Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.s390x	—	Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2023-52639

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-21823

Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-26642

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-26808

A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nft_chain_filter feature. This issue occurs when a NETDEV_UNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale reference could result in lingering issues with network device handling.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-26993

In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released. Fix the leak by adding an explicit kobject_put() call when kn is NULL.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-27393

In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")). This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-27397

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-27403

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-35897

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-35898

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable(). And thhere is not any protection when iterate over nf_tables_flowtables list in __nft_flowtable_type_get(). Therefore, there is pertential data-race of nf_tables_flowtables list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller nft_flowtable_type_get() to protect the entire type query process.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-36886

A use-after-free (UAF) flaw exists in the Linux Kernel within the reassembly of fragmented TIPC messages, specifically in the tipc_buf_append() function. The issue results due to a lack of checks in the error handling cleanup and can trigger a UAF on "struct sk_buff", which may lead to remote code execution.

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Important

CVE-2024-36971

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 218 products

Product	Version	Remediation
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-abi-stablelists-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-aarch64-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-ppc64le-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-s390x-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-debuginfo-common-x86_64-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-doc-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:kernel-zfcpdump-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-abi-stablelists-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-core-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debug-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-aarch64-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-ppc64le-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-s390x-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-debuginfo-common-x86_64-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-devel-matched-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-doc-0:5.14.0-70.112.1.el9_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-headers-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-modules-extra-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-tools-libs-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-core-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-devel-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-devel-matched-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-modules-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:kernel-zfcpdump-modules-extra-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.0.0.Z.E4S:python3-perf-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64	—	Vendor Fix fix Workaround

Threats

Exploit Status CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Impact Important

CVE-2024-39502

In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). Reproducer: ethtool -L <interface name> rx 1 tx 1 combined 0 ethtool -L <interface name> rx 0 tx 0 combined 1 ethtool -L <interface name> rx 0 tx 0 combined 4 Splat looks like: kernel BUG at net/core/dev.c:6666! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_work [ionic] RIP: 0010:napi_enable+0x3b/0x40 Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28 RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20 FS: 0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? die+0x33/0x90 ? do_trap+0xd9/0x100 ? napi_enable+0x3b/0x40 ? do_error_trap+0x83/0xb0 ? napi_enable+0x3b/0x40 ? napi_enable+0x3b/0x40 ? exc_invalid_op+0x4e/0x70 ? napi_enable+0x3b/0x40 ? asm_exc_invalid_op+0x16/0x20 ? napi_enable+0x3b/0x40 ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] process_one_work+0x145/0x360 worker_thread+0x2bb/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Moderate

CVE-2024-40978

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix crash while reading debugfs attribute The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash. To fix this issue, use a small local stack buffer for sprintf() and then call simple_read_from_buffer(), which in turns make the copy_to_user() call. BUG: unable to handle page fault for address: 00007f4801111000 PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 Oops: 0002 [#1] PREEMPT SMP PTI Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 RIP: 0010:memcpy_orig+0xcd/0x130 RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x183/0x510 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x22/0x30 ? memcpy_orig+0xcd/0x130 vsnprintf+0x102/0x4c0 sprintf+0x51/0x80 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] full_proxy_read+0x50/0x80 vfs_read+0xa5/0x2e0 ? folio_add_new_anon_rmap+0x44/0xa0 ? set_pte_at+0x15/0x30 ? do_pte_missing+0x426/0x7f0 ksys_read+0xa5/0xe0 do_syscall_64+0x58/0x80 ? __count_memcg_events+0x46/0x90 ? count_memcg_event_mm+0x3d/0x60 ? handle_mm_fault+0x196/0x2f0 ? do_user_addr_fault+0x267/0x890 ? exc_page_fault+0x69/0x150 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f4800f20b4d

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-822 - Untrusted Pointer Dereference

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Low

CVE-2024-41090

A denial of service (DoS) attack was found in the mlx5 driver in the Linux kernel. A KVM guest VM using virtio-net can crash the host by sending a short packet, for example, size < ETH_HLEN. The packet may traverse through vhost-net, macvtap, and vlan without any validation or drop. When this packet is presented to the mlx5 driver on the host side, the kernel panic happens since mlx5_core assumes the frame size is always >= ETH_HLEN.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Important

CVE-2024-41091

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 210 products, the same list as for CVE-2021-47624

Known not affected 8 products, the same list as for CVE-2021-47624

Threats

Impact Important

References

107 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:5257	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2270881	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273080	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273405	external
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278314	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278989	external
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2280745	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281127	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281669	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281672	external
https://bugzilla.redhat.com/show_bug.cgi?id=2292331	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297474	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297562	external
https://bugzilla.redhat.com/show_bug.cgi?id=2298108	external
https://bugzilla.redhat.com/show_bug.cgi?id=2299240	external
https://bugzilla.redhat.com/show_bug.cgi?id=2299336	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-47624	self
https://bugzilla.redhat.com/show_bug.cgi?id=2298108	external
https://www.cve.org/CVERecord?id=CVE-2021-47624	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47624	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2023-52639	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273080	external
https://www.cve.org/CVERecord?id=CVE-2023-52639	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52639	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-21823	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278989	external
https://www.cve.org/CVERecord?id=CVE-2024-21823	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21823	external
https://access.redhat.com/security/cve/CVE-2024-26642	self
https://bugzilla.redhat.com/show_bug.cgi?id=2270881	external
https://www.cve.org/CVERecord?id=CVE-2024-26642	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26642	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2024-26808	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273405	external
https://www.cve.org/CVERecord?id=CVE-2024-26808	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26808	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26993	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278314	external
https://www.cve.org/CVERecord?id=CVE-2024-26993	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26993	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27393	self
https://bugzilla.redhat.com/show_bug.cgi?id=2280745	external
https://www.cve.org/CVERecord?id=CVE-2024-27393	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27393	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://www.cve.org/CVERecord?id=CVE-2024-27397	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27397	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27403	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281127	external
https://www.cve.org/CVERecord?id=CVE-2024-27403	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27403	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35897	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281672	external
https://www.cve.org/CVERecord?id=CVE-2024-35897	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35897	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35898	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281669	external
https://www.cve.org/CVERecord?id=CVE-2024-35898	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35898	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://www.cve.org/CVERecord?id=CVE-2024-36886	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36886	external
https://lore.kernel.org/all/752f1ccf762223d109845…	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36971	self
https://bugzilla.redhat.com/show_bug.cgi?id=2292331	external
https://www.cve.org/CVERecord?id=CVE-2024-36971	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36971	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://access.redhat.com/security/cve/CVE-2024-39502	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297474	external
https://www.cve.org/CVERecord?id=CVE-2024-39502	external
https://nvd.nist.gov/vuln/detail/CVE-2024-39502	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40978	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297562	external
https://www.cve.org/CVERecord?id=CVE-2024-40978	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40978	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41090	self
https://bugzilla.redhat.com/show_bug.cgi?id=2299240	external
https://www.cve.org/CVERecord?id=CVE-2024-41090	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41090	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://www.openwall.com/lists/oss-security/2024/…	external
https://access.redhat.com/security/cve/CVE-2024-41091	self
https://bugzilla.redhat.com/show_bug.cgi?id=2299336	external
https://www.cve.org/CVERecord?id=CVE-2024-41091	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41091	external
https://lore.kernel.org/linux-cve-announce/202407…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2024-35898 (GCVE-0-2024-35898)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30

Title

netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

Summary

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-29 18:29 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/69d1fe14a680042ec…
https://git.kernel.org/stable/c/a347bc8e6251eaee4…
https://git.kernel.org/stable/c/940d41caa71f0d3a5…
https://git.kernel.org/stable/c/2485bcfe05ee3cf9c…
https://git.kernel.org/stable/c/9b5b7708ec2be21dd…
https://git.kernel.org/stable/c/8b891153b2e4dc0ca…
https://git.kernel.org/stable/c/e684b1674fd1ca436…
https://git.kernel.org/stable/c/24225011d81b471ac…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 69d1fe14a680042ec913f22196b58e2c8ff1b007 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < a347bc8e6251eaee4b619da28020641eb5b0dd77 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 940d41caa71f0d3a52df2fde5fada524a993e331 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 2485bcfe05ee3cf9ca8923a94fa2e456924c79c8 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 9b5b7708ec2be21dd7ef8ca0e3abe4ae9f3b083b (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 8b891153b2e4dc0ca9d9dab8f619d49c740813df (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < e684b1674fd1ca4361812a491242ae871d6b2859 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 24225011d81b471acc0e1e315b7d9905459a6304 (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 4.19.312 , ≤ 4.19.* (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.85 , ≤ 6.1.* (semver) Unaffected: 6.6.26 , ≤ 6.6.* (semver) Unaffected: 6.8.5 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T18:29:13.616197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T19:40:06.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/69d1fe14a680042ec913f22196b58e2c8ff1b007"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a347bc8e6251eaee4b619da28020641eb5b0dd77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/940d41caa71f0d3a52df2fde5fada524a993e331"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2485bcfe05ee3cf9ca8923a94fa2e456924c79c8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b5b7708ec2be21dd7ef8ca0e3abe4ae9f3b083b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b891153b2e4dc0ca9d9dab8f619d49c740813df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e684b1674fd1ca4361812a491242ae871d6b2859"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24225011d81b471acc0e1e315b7d9905459a6304"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:34.280Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69d1fe14a680042ec913f22196b58e2c8ff1b007",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "a347bc8e6251eaee4b619da28020641eb5b0dd77",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "940d41caa71f0d3a52df2fde5fada524a993e331",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "2485bcfe05ee3cf9ca8923a94fa2e456924c79c8",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "9b5b7708ec2be21dd7ef8ca0e3abe4ae9f3b083b",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "8b891153b2e4dc0ca9d9dab8f619d49c740813df",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "e684b1674fd1ca4361812a491242ae871d6b2859",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "24225011d81b471acc0e1e315b7d9905459a6304",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()\n\nnft_unregister_flowtable_type() within nf_flow_inet_module_exit() can\nconcurrent with __nft_flowtable_type_get() within nf_tables_newflowtable().\nAnd thhere is not any protection when iterate over nf_tables_flowtables\nlist in __nft_flowtable_type_get(). Therefore, there is pertential\ndata-race of nf_tables_flowtables list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_flowtables list\nin __nft_flowtable_type_get(), and use rcu_read_lock() in the caller\nnft_flowtable_type_get() to protect the entire type query process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the nfnetlink/nftables netlink socket interface (NFT_MSG_NEWFLOWTABLE batch message), which requires local system access. Per kernel scoring guidance, netfilter/nftables netlink paths are Local.\nAC:H - The attacker fully controls the reader side by spamming NFT_MSG_NEWFLOWTABLE, but the writer side is `nft_unregister_flowtable_type()`, reachable only from `nf_flow_inet_module_exit()` \u2014 i.e. an `rmmod` requiring real CAP_SYS_MODULE in the init namespace, which an unprivileged attacker cannot influence. Winning the window between latching `type` and `try_module_get(type-\u003eowner)` therefore depends on a privileged event outside attacker control.\nPR:L - `nfnetlink_rcv()` checks `netlink_net_capable(skb, CAP_NET_ADMIN)`, which evaluates against `sock_net(sk)-\u003euser_ns`, so an unprivileged user obtains the needed capability with `unshare -Urn`. No real root is required on the attacker\u0027s side of the race.\nUI:N - Exploitation requires only that the attacker issue netlink requests in a loop; no victim opens a file, mounts a filesystem, or otherwise participates. The concurrent administrative module unload is accounted for in Attack Complexity, not User Interaction.\nS:U - The race, the dangling pointer, and its consequences are all confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unprotected traversal yields a dangling `struct nf_flowtable_type *` into freed module memory, which is then dereferenced (`type-\u003efamily`, `type-\u003eowner`) and chased into `struct module` inside `try_module_get()`. Per kernel guidance a use-after-free is scored High, since reclaimed memory contents become readable through the stale pointer.\nI:H - `try_module_get()` performs `atomic_inc_not_zero(\u0026module-\u003erefcnt)` through a pointer read from freed memory, and on success `nf_tables_newflowtable()` stores the stale `type` and invokes `type-\u003einit()` while `nft_flowtable_parse_hook()` installs `type-\u003ehook` as a live packet-processing callback \u2014 a control-flow hijack primitive if the module region is reclaimed. Use-after-free with function-pointer dereference is High integrity impact.\nA:H - Module memory is released via `execmem_free()`, so dereferencing the stale `type` typically faults on unmapped kernel address space, producing an oops/panic. Any use-after-free of this kind is scored High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:49.837Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69d1fe14a680042ec913f22196b58e2c8ff1b007"
        },
        {
          "url": "https://git.kernel.org/stable/c/a347bc8e6251eaee4b619da28020641eb5b0dd77"
        },
        {
          "url": "https://git.kernel.org/stable/c/940d41caa71f0d3a52df2fde5fada524a993e331"
        },
        {
          "url": "https://git.kernel.org/stable/c/2485bcfe05ee3cf9ca8923a94fa2e456924c79c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5b7708ec2be21dd7ef8ca0e3abe4ae9f3b083b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b891153b2e4dc0ca9d9dab8f619d49c740813df"
        },
        {
          "url": "https://git.kernel.org/stable/c/e684b1674fd1ca4361812a491242ae871d6b2859"
        },
        {
          "url": "https://git.kernel.org/stable/c/24225011d81b471acc0e1e315b7d9905459a6304"
        }
      ],
      "title": "netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35898",
    "datePublished": "2024-05-19T08:34:52.519Z",
    "dateReserved": "2024-05-17T13:50:33.114Z",
    "dateUpdated": "2026-08-05T11:30:49.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36886 (GCVE-0-2024-36886)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:28 – Updated: 2026-08-05 11:31

Title

tipc: fix UAF in error path

Summary

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 Read of size 8 at addr ffff88804d2a7c80 by task poc/8034 CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 Call Trace: <IRQ> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:377 print_report+0xc4/0x620 linux/mm/kasan/report.c:488 kasan_report+0xda/0x110 linux/mm/kasan/report.c:601 kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026 skb_release_all linux/net/core/skbuff.c:1094 __kfree_skb linux/net/core/skbuff.c:1108 kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144 kfree_skb linux/./include/linux/skbuff.h:1244 tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186 tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324 tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824 tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159 tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390 udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346 __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422 ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254 dst_input linux/./include/net/dst.h:461 ip_rcv_finish linux/net/ipv4/ip_input.c:449 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534 __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648 process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976 __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576 napi_poll linux/net/core/dev.c:6645 net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781 __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553 do_softirq linux/kernel/softirq.c:454 do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441 </IRQ> <TASK> __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381 local_bh_enable linux/./include/linux/bottom_half.h:33 rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851 __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378 dev_queue_xmit linux/./include/linux/netdevice.h:3169 neigh_hh_output linux/./include/net/neighbour.h:526 neigh_output linux/./include/net/neighbour.h:540 ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235 __ip_finish_output linux/net/ipv4/ip_output.c:313 __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323 NF_HOOK_COND linux/./include/linux/netfilter.h:303 ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433 dst_output linux/./include/net/dst.h:451 ip_local_out linux/net/ipv4/ip_output.c:129 ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492 udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963 udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250 inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850 sock_sendmsg_nosec linux/net/socket.c:730 __sock_sendmsg linux/net/socket.c:745 __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191 __do_sys_sendto linux/net/socket.c:2203 __se_sys_sendto linux/net/socket.c:2199 __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199 do_syscall_x64 linux/arch/x86/entry/common.c:52 do_syscall_ ---truncated---

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-22 03:55 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e19ec8ab0e25bc480…
https://git.kernel.org/stable/c/93bc2d6d16f2c3178…
https://git.kernel.org/stable/c/367766ff9e407f8a6…
https://git.kernel.org/stable/c/66116556076f0b96b…
https://git.kernel.org/stable/c/21ea04aad8a0839b4…
https://git.kernel.org/stable/c/ffd4917c1edb3c3ff…
https://git.kernel.org/stable/c/a0fbb26f8247e326a…
https://git.kernel.org/stable/c/080cbb890286cd794…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://security.netapp.com/advisory/ntap-2024101…

Impacted products

4 products

Vendor	Product	Version
Linux	Linux	Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < e19ec8ab0e25bc4803d7cc91c84e84532e2781bd (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 93bc2d6d16f2c3178736ba6b845b30475856dc40 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 367766ff9e407f8a68409b7ce4dc4d5a72afeab1 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 66116556076f0b96bc1aa9844008c743c8c67684 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 21ea04aad8a0839b4ec27ef1691ca480620e8e14 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < ffd4917c1edb3c3ff334fce3704fbe9c39f35682 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < a0fbb26f8247e326a320e2cb4395bfb234332c90 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 080cbb890286cd794f1ee788bbc5463e2deb7c2b (git)
Linux	Linux	Affected: 4.1 Unaffected: 0 , < 4.1 (semver) Unaffected: 4.19.314 , ≤ 4.19.* (semver) Unaffected: 5.4.276 , ≤ 5.4.* (semver) Unaffected: 5.10.217 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 4.1 cpe:2.3:o:linux:linux_kernel:4.1:-::::::
linux	linux_kernel	Affected: 1149557d64c9 , < e19ec8ab0e25 (custom) Affected: 1149557d64c9 , < 93bc2d6d16f2 (custom) Affected: 1149557d64c9 , < 367766ff9e40 (custom) Affected: 1149557d64c9 , < 66116556076f (custom) Affected: 1149557d64c9 , < 21ea04aad8a0 (custom) Affected: 1149557d64c9 , < ffd4917c1edb (custom) Affected: 1149557d64c9 , < a0fbb26f8247 (custom) Affected: 1149557d64c9 , < 080cbb890286 (custom) cpe:2.3:o:linux:linux_kernel::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.1:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e19ec8ab0e25",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "93bc2d6d16f2",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "367766ff9e40",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "66116556076f",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "21ea04aad8a0",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "ffd4917c1edb",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "a0fbb26f8247",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "080cbb890286",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-22T03:55:33.064938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T12:40:50.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-18T13:07:39.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241018-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e19ec8ab0e25bc4803d7cc91c84e84532e2781bd",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "93bc2d6d16f2c3178736ba6b845b30475856dc40",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "367766ff9e407f8a68409b7ce4dc4d5a72afeab1",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "66116556076f0b96bc1aa9844008c743c8c67684",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "21ea04aad8a0839b4ec27ef1691ca480620e8e14",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "ffd4917c1edb3c3ff334fce3704fbe9c39f35682",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "a0fbb26f8247e326a320e2cb4395bfb234332c90",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "080cbb890286cd794f1ee788bbc5463e2deb7c2b",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.314",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.314",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.276",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in error path\n\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\n\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\n\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable reassembly code is reached directly from received network packets via the TIPC UDP bearer (`tipc_udp_recv` on routable UDP port 6118 \u2192 `tipc_rcv` \u2192 `tipc_link_rcv` \u2192 `tipc_link_input` \u2192 `tipc_buf_append`), as shown in the reporter\u0027s own KASAN stack trace. The attacker only needs IP reachability to the bearer address, not link-layer adjacency.\nAC:L - The error path is entered whenever `tipc_msg_validate()` rejects the reassembled message, and every field it checks (version, header size, message size, length) lives in the attacker-supplied fragment payload, so a FIRST_FRAGMENT followed by a malformed LAST_FRAGMENT triggers the UAF deterministically. There is no race and no memory-layout condition outside the attacker\u0027s influence \u2014 skb heap grooming is done by the attacker\u0027s own packet stream.\nPR:N - TIPC neighbour discovery and link establishment (`tipc_disc_rcv` \u2192 `tipc_node_check_dest`) perform no authentication whatsoever; only a matching net_id (default 4711) is required, and TIPC_CRYPTO is a non-default option. An unauthenticated remote peer can bring up a link and immediately send the malicious fragment sequence.\nUI:N - The whole path executes in softirq/NAPI context on packet arrival with no involvement from any local user or application. No victim action of any kind is needed.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary. Impact is standard kernel-level compromise.\nC:H - This is a use-after-free/double-free of an skb: `kfree_skb_list_reason()` dereferences the freed fragment\u0027s `next` pointer, and the freed object can be reclaimed and filled with attacker-chosen data via network skb spraying, yielding a controlled read primitive and kernel memory disclosure.\nI:H - The coalesce path double-frees the skb into `skbuff_cache`, and the frag_list path causes `__kfree_skb()` on an attacker-controlled `next` pointer \u2014 classic type-confusion/arbitrary-free primitives that are leverageable into arbitrary kernel writes and control-flow hijack.\nA:H - The flaw is a KASAN-confirmed slab use-after-free plus double free in softirq context, which reliably oopses or panics the kernel on unpatched systems. It can be re-triggered at will by an unauthenticated remote peer for a persistent remote DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:51.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40"
        },
        {
          "url": "https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
        },
        {
          "url": "https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90"
        },
        {
          "url": "https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b"
        }
      ],
      "title": "tipc: fix UAF in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36886",
    "datePublished": "2024-05-30T15:28:55.059Z",
    "dateReserved": "2024-05-30T15:25:07.065Z",
    "dateUpdated": "2026-08-05T11:31:51.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36971 (GCVE-0-2024-36971)

Vulnerability from cvelistv5 – Published: 2024-06-10 09:03 – Updated: 2026-08-05 11:32

Title

net: fix __dst_negative_advice() race

Summary

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-08 03:55 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/051c0bde9f0450a2e…
https://git.kernel.org/stable/c/db0082825037794c5…
https://git.kernel.org/stable/c/2295a7ef5c8c49241…
https://git.kernel.org/stable/c/eacb8b195579c174a…
https://git.kernel.org/stable/c/81dd3c82a456b0015…
https://git.kernel.org/stable/c/5af198c387128a9d2…
https://git.kernel.org/stable/c/b8af8e6118a6605f0…
https://git.kernel.org/stable/c/92f1655aa2b2294d0…
https://lists.debian.org/debian-lts-announce/2024…
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

13 products

Vendor	Product	Version
Linux	Linux	Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < db0082825037794c5dba9959c9de13ca34cc5e72 (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < 2295a7ef5c8c49241bff769e7826ef2582e532a6 (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < eacb8b195579c174a6d3e12a9690b206eb7f28cf (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < 81dd3c82a456b0015461754be7cb2693991421b4 (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < 5af198c387128a9d2ddd620b0f0803564a4d4508 (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < b8af8e6118a6605f0e495a58d591ca94a85a50fc (git) Affected: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 , < 92f1655aa2b2294d0b49925f3b875a634bd3b59e (git)
Linux	Linux	Affected: 4.6 Unaffected: 0 , < 4.6 (semver) Unaffected: 4.19.316 , ≤ 4.19.* (semver) Unaffected: 5.4.278 , ≤ 5.4.* (semver) Unaffected: 5.10.219 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.94 , ≤ 6.1.* (semver) Unaffected: 6.6.34 , ≤ 6.6.* (semver) Unaffected: 6.9.4 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 4.6 cpe:2.3:o:linux:linux_kernel:4.6:::::::*
linux	linux_kernel	Affected: a87cb3e48ee8 , < 051c0bde9f04 (git) Affected: a87cb3e48ee8 , < db0082825037 (git) Affected: a87cb3e48ee8 , < 2295a7ef5c8c (git) Affected: a87cb3e48ee8 , < eacb8b195579 (git) Affected: a87cb3e48ee8 , < 81dd3c82a456 (git) Affected: a87cb3e48ee8 , < 5af198c38712 (git) Affected: a87cb3e48ee8 , < b8af8e6118a6 (git) Affected: a87cb3e48ee8 , < 92f1655aa2b2 (git) cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	Unaffected: 0 , < 4.6 (custom) cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	Unaffected: 4.19.316 , < 4.20 (custom) cpe:2.3:o:linux:linux_kernel:4.19.316:::::::*
linux	linux_kernel	Unaffected: 5.4.278 , < 5.5 (custom) cpe:2.3:o:linux:linux_kernel:5.4.278:::::::*
linux	linux_kernel	Unaffected: 5.10.219 , < 5.11 (custom) cpe:2.3:o:linux:linux_kernel:5.10.219:::::::*
linux	linux_kernel	Unaffected: 5.15.161 , < 5.16 (custom) cpe:2.3:o:linux:linux_kernel:5.15.161:::::::*
linux	linux_kernel	Unaffected: 6.1.94 , < 6.2 (custom) cpe:2.3:o:linux:linux_kernel:6.1.94:::::::*
linux	linux_kernel	Unaffected: 6.6.34 , < 6.7 (custom) cpe:2.3:o:linux:linux_kernel:6.6.34:::::::*
linux	linux_kernel	Unaffected: 6.9.4 , < 6.10 (custom) cpe:2.3:o:linux:linux_kernel:6.9.4:::::::*
linux	linux_kernel	Unaffected: 6.10 , ≤ * (custom) cpe:2.3:o:linux:linux_kernel:6.10:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:21:17.010Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.6:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.6"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "051c0bde9f04",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "db0082825037",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "2295a7ef5c8c",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "eacb8b195579",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "81dd3c82a456",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "5af198c38712",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "b8af8e6118a6",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              },
              {
                "lessThan": "92f1655aa2b2",
                "status": "affected",
                "version": "a87cb3e48ee8",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "4.6",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.19.316:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "4.20",
                "status": "unaffected",
                "version": "4.19.316",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.4.278:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.5",
                "status": "unaffected",
                "version": "5.4.278",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.10.219:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.11",
                "status": "unaffected",
                "version": "5.10.219",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.15.161:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.16",
                "status": "unaffected",
                "version": "5.15.161",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.1.94:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.2",
                "status": "unaffected",
                "version": "6.1.94",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.6.34:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.7",
                "status": "unaffected",
                "version": "6.6.34",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.9.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.10",
                "status": "unaffected",
                "version": "6.9.4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36971",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T03:55:25.565547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-08-07",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:56:22.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-08-07T00:00:00.000Z",
            "value": "CVE-2024-36971 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/dst_ops.h",
            "include/net/sock.h",
            "net/ipv4/route.c",
            "net/ipv6/route.c",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "051c0bde9f0450a2ec3d62a86d2a0d2fad117f13",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "db0082825037794c5dba9959c9de13ca34cc5e72",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "2295a7ef5c8c49241bff769e7826ef2582e532a6",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "eacb8b195579c174a6d3e12a9690b206eb7f28cf",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "81dd3c82a456b0015461754be7cb2693991421b4",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "5af198c387128a9d2ddd620b0f0803564a4d4508",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "b8af8e6118a6605f0e495a58d591ca94a85a50fc",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            },
            {
              "lessThan": "92f1655aa2b2294d0b49925f3b875a634bd3b59e",
              "status": "affected",
              "version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/dst_ops.h",
            "include/net/sock.h",
            "net/ipv4/route.c",
            "net/ipv6/route.c",
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.94",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk-\u003edst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk-\u003esk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three -\u003enegative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race must be driven by two concurrent local socket operations on the same fd \u2014 `setsockopt(SO_CNX_ADVICE)` and a lockless `udp_sendmsg()` \u2014 so the attacker needs local syscall access. A remote peer can drive only the free side (TCP retransmit timeouts, ICMP-induced PMTU/redirect exceptions), not the racing `sk_dst_cache` writer.\nAC:L - The attacker controls both sides of the race (one thread calling `SO_CNX_ADVICE`, another calling `sendmsg()` on the same connected socket) and can create the required route-exception/obsolete-dst precondition at will, retrying indefinitely across many sockets; in-the-wild exploitation confirms it is reliably winnable.\nPR:L - `SO_CNX_ADVICE` in `sock_setsockopt()` carries no capability check and a connected UDP socket needs no privileges, so any unprivileged local user \u2014 including a sandboxed Android app, as in the observed real-world exploit \u2014 can reach the code.\nUI:N - Exploitation is entirely self-driven through the attacker\u0027s own socket, timers and threads; no victim action is needed.\nS:U - The corrupted `dst_entry` and the resulting code execution are both within the kernel\u0027s own security authority \u2014 standard local privilege escalation, no VM/IOMMU boundary crossed.\nC:H - The refcount underflow yields a use-after-free on a `dst_entry` whose contents (ops table, metrics, neighbour and function pointers) can be replaced by attacker-sprayed data, giving a kernel read primitive and full disclosure once escalated to root.\nI:H - `dst_entry` holds `ops`, `input()` and `output()` function pointers invoked on every transmit, so reclaiming the freed object gives direct control-flow hijack and arbitrary kernel write \u2014 this was weaponized as an in-the-wild Android privilege escalation.\nA:H - Even unweaponized, the premature free and dangling `sk_dst_cache` dereference cause refcount WARNs, memory corruption and kernel oops/panic, and the trigger can be repeated freely by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:22.196Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13"
        },
        {
          "url": "https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72"
        },
        {
          "url": "https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e"
        }
      ],
      "title": "net: fix __dst_negative_advice() race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36971",
    "datePublished": "2024-06-10T09:03:23.878Z",
    "dateReserved": "2024-05-30T15:25:07.082Z",
    "dateUpdated": "2026-08-05T11:32:22.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-39502 (GCVE-0-2024-39502)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2026-08-05 11:33

Title

ionic: fix use after netif_napi_del()

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:07 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/0d19267cb150e8f76…
https://git.kernel.org/stable/c/ff9c2a9426ecf5b96…
https://git.kernel.org/stable/c/8edd18dab443863e9…
https://git.kernel.org/stable/c/60cd714871cd5a683…
https://git.kernel.org/stable/c/183ebc167a8a19e91…
https://git.kernel.org/stable/c/a87d72b37b9ec2c1e…
https://git.kernel.org/stable/c/79f18a41dd056115d…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < 0d19267cb150e8f76ade210e16ee820a77f684e7 (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < ff9c2a9426ecf5b9631e9fd74993b357262387d6 (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < 8edd18dab443863e9e48f084e7f123fca3065e4e (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < 60cd714871cd5a683353a355cbb17a685245cf84 (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < 183ebc167a8a19e916b885d4bb61a3491991bfa5 (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < a87d72b37b9ec2c1e18fe36b09241d8b30334a2e (git) Affected: 0f3154e6bcb354968cc04f7cd86ce466f7b9a814 , < 79f18a41dd056115d685f3b0a419c7cd40055e13 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.4.279 , ≤ 5.4.* (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.162 , ≤ 5.15.* (semver) Unaffected: 6.1.95 , ≤ 6.1.* (semver) Unaffected: 6.6.35 , ≤ 6.6.* (semver) Unaffected: 6.9.6 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.1 (custom)
Siemens	RUGGEDCOM RST2428P	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Affected: 0 , < V3.1 (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Unaffected: 0 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:56:21.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d19267cb150e8f76ade210e16ee820a77f684e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff9c2a9426ecf5b9631e9fd74993b357262387d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8edd18dab443863e9e48f084e7f123fca3065e4e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60cd714871cd5a683353a355cbb17a685245cf84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/183ebc167a8a19e916b885d4bb61a3491991bfa5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a87d72b37b9ec2c1e18fe36b09241d8b30334a2e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79f18a41dd056115d685f3b0a419c7cd40055e13"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:07.252622Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:40.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:55:35.054Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d19267cb150e8f76ade210e16ee820a77f684e7",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "ff9c2a9426ecf5b9631e9fd74993b357262387d6",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "8edd18dab443863e9e48f084e7f123fca3065e4e",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "60cd714871cd5a683353a355cbb17a685245cf84",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "183ebc167a8a19e916b885d4bb61a3491991bfa5",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "a87d72b37b9ec2c1e18fe36b09241d8b30334a2e",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            },
            {
              "lessThan": "79f18a41dd056115d685f3b0a419c7cd40055e13",
              "status": "affected",
              "version": "0f3154e6bcb354968cc04f7cd86ce466f7b9a814",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: fix use after netif_napi_del()\n\nWhen queues are started, netif_napi_add() and napi_enable() are called.\nIf there are 4 queues and only 3 queues are used for the current\nconfiguration, only 3 queues\u0027 napi should be registered and enabled.\nThe ionic_qcq_enable() checks whether the .poll pointer is not NULL for\nenabling only the using queue\u0027 napi. Unused queues\u0027 napi will not be\nregistered by netif_napi_add(), so the .poll pointer indicates NULL.\nBut it couldn\u0027t distinguish whether the napi was unregistered or not\nbecause netif_napi_del() doesn\u0027t reset the .poll pointer to NULL.\nSo, ionic_qcq_enable() calls napi_enable() for the queue, which was\nunregistered by netif_napi_del().\n\nReproducer:\n   ethtool -L \u003cinterface name\u003e rx 1 tx 1 combined 0\n   ethtool -L \u003cinterface name\u003e rx 0 tx 0 combined 1\n   ethtool -L \u003cinterface name\u003e rx 0 tx 0 combined 4\n\nSplat looks like:\nkernel BUG at net/core/dev.c:6666!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16\nWorkqueue: events ionic_lif_deferred_work [ionic]\nRIP: 0010:napi_enable+0x3b/0x40\nCode: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f\nRSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029\nRDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28\nRBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000\nR13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20\nFS:  0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? die+0x33/0x90\n ? do_trap+0xd9/0x100\n ? napi_enable+0x3b/0x40\n ? do_error_trap+0x83/0xb0\n ? napi_enable+0x3b/0x40\n ? napi_enable+0x3b/0x40\n ? exc_invalid_op+0x4e/0x70\n ? napi_enable+0x3b/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? napi_enable+0x3b/0x40\n ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n process_one_work+0x145/0x360\n worker_thread+0x2bb/0x3d0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xcc/0x100\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a local `ethtool -L` operation on the netdev, delivered via the ethtool ioctl or the ethtool generic-netlink family \u2014 no network packet from a remote peer reaches the vulnerable code. Attack requires local access to the system or container hosting the ionic netdev.\nAC:L - The upstream reproducer is a deterministic three-command sequence (`ethtool -L ... rx 1 tx 1 combined 0`, then `combined 1`, then `combined 4`) with no race and no dependence on memory layout or system state the attacker cannot influence. The link-status event that drives the crashing deferred work is generated by the reconfiguration itself via `ionic_link_status_check_request()`.\nPR:L - Both entry points gate on namespace-relative CAP_NET_ADMIN (`ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` in net/ethtool/ioctl.c:2912 and `GENL_UNS_ADMIN_PERM` in net/ethtool/netlink.c:921), which an unprivileged user holds inside their own user namespace. ionic exposes SR-IOV VFs that are routinely delegated into container network namespaces by SR-IOV CNI, so a basic container user reaches `ionic_set_channels` without any host-root privilege.\nUI:N - The entire sequence is attacker-driven from a single process; no administrator or victim action is needed. The queue restart that reaches `ionic_qcq_enable()` is triggered automatically by the attacker\u0027s own reconfiguration.\nS:U - The corruption and the crash are confined to the kernel\u0027s own security authority \u2014 there is no hypervisor, IOMMU, or DMA boundary being crossed. This is standard in-kernel memory corruption, so the vulnerable component and impacted component share one authority.\nC:H - Re-enabling a NAPI that `netif_napi_del()` already unlinked leaves it schedulable from the still-registered IRQ while the containing `struct ionic_qcq` is `devm_kfree()`d, so `net_rx_action()` polls freed slab memory \u2014 a use-after-free that yields an arbitrary kernel-memory read primitive once the object is resprayed.\nI:H - The same use-after-free makes `n-\u003epoll` an indirect call through freed, attacker-sprayable slab memory, giving a control-flow-hijack and arbitrary-write primitive. Per UAF scoring guidance this is High integrity impact, not a mere crash.\nA:H - `napi_enable()` hits `BUG_ON(!test_bit(NAPI_STATE_SCHED, \u0026val))` (net/core/dev.c:6665) and kills the kworker while it holds `lif-\u003equeue_lock`, which is then leaked permanently \u2014 every subsequent `ionic_open`/`ionic_stop`/ethtool path blocks on it while holding `rtnl_lock`, deadlocking the whole networking control plane until reboot (immediate panic with `panic_on_oops=1`)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:48.153Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d19267cb150e8f76ade210e16ee820a77f684e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff9c2a9426ecf5b9631e9fd74993b357262387d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8edd18dab443863e9e48f084e7f123fca3065e4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/60cd714871cd5a683353a355cbb17a685245cf84"
        },
        {
          "url": "https://git.kernel.org/stable/c/183ebc167a8a19e916b885d4bb61a3491991bfa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a87d72b37b9ec2c1e18fe36b09241d8b30334a2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/79f18a41dd056115d685f3b0a419c7cd40055e13"
        }
      ],
      "title": "ionic: fix use after netif_napi_del()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39502",
    "datePublished": "2024-07-12T12:20:35.635Z",
    "dateReserved": "2024-06-25T14:23:23.752Z",
    "dateUpdated": "2026-08-05T11:33:48.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40978 (GCVE-0-2024-40978)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:32 – Updated: 2026-05-12 11:56

Title

scsi: qedi: Fix crash while reading debugfs attribute

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:02 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/56bec63a7fc87ad50…
https://git.kernel.org/stable/c/21c963de2e86e88f6…
https://git.kernel.org/stable/c/144d76a676b630e32…
https://git.kernel.org/stable/c/397a8990c377ee4b6…
https://git.kernel.org/stable/c/eaddb86637669f6ba…
https://git.kernel.org/stable/c/fa85b016a56b9775a…
https://git.kernel.org/stable/c/e2f433ea7d0ff7799…
https://git.kernel.org/stable/c/28027ec8e32ecbadc…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < 56bec63a7fc87ad50b3373a87517dc9770eef9e0 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < 21c963de2e86e88f6a8ca556bcebb8e62ab8e901 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < 144d76a676b630e321556965011b00e2de0b40a7 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < 397a8990c377ee4b61d6df768e61dff9e316d46b (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < eaddb86637669f6bad89245ee63f8fb2bfb50241 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < fa85b016a56b9775a3fe41e5d26e666945963b46 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < e2f433ea7d0ff77998766a088a287337fb43ad75 (git) Affected: ace7f46ba5fde7273207c7122b0650ceb72510e0 , < 28027ec8e32ecbadcd67623edb290dad61e735b5 (git)
Linux	Linux	Affected: 4.10 Unaffected: 0 , < 4.10 (semver) Unaffected: 4.19.317 , ≤ 4.19.* (semver) Unaffected: 5.4.279 , ≤ 5.4.* (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.162 , ≤ 5.15.* (semver) Unaffected: 6.1.96 , ≤ 6.1.* (semver) Unaffected: 6.6.36 , ≤ 6.6.* (semver) Unaffected: 6.9.7 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Unaffected: 0 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:43.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/56bec63a7fc87ad50b3373a87517dc9770eef9e0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21c963de2e86e88f6a8ca556bcebb8e62ab8e901"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/144d76a676b630e321556965011b00e2de0b40a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/397a8990c377ee4b61d6df768e61dff9e316d46b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eaddb86637669f6bad89245ee63f8fb2bfb50241"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fa85b016a56b9775a3fe41e5d26e666945963b46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e2f433ea7d0ff77998766a088a287337fb43ad75"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28027ec8e32ecbadcd67623edb290dad61e735b5"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40978",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:02:30.760177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:21.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:01.705Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qedi/qedi_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56bec63a7fc87ad50b3373a87517dc9770eef9e0",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "21c963de2e86e88f6a8ca556bcebb8e62ab8e901",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "144d76a676b630e321556965011b00e2de0b40a7",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "397a8990c377ee4b61d6df768e61dff9e316d46b",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "eaddb86637669f6bad89245ee63f8fb2bfb50241",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "fa85b016a56b9775a3fe41e5d26e666945963b46",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "e2f433ea7d0ff77998766a088a287337fb43ad75",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            },
            {
              "lessThan": "28027ec8e32ecbadcd67623edb290dad61e735b5",
              "status": "affected",
              "version": "ace7f46ba5fde7273207c7122b0650ceb72510e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qedi/qedi_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.317",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix crash while reading debugfs attribute\n\nThe qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly\non a __user pointer, which results into the crash.\n\nTo fix this issue, use a small local stack buffer for sprintf() and then\ncall simple_read_from_buffer(), which in turns make the copy_to_user()\ncall.\n\nBUG: unable to handle page fault for address: 00007f4801111000\nPGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0\nOops: 0002 [#1] PREEMPT SMP PTI\nHardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023\nRIP: 0010:memcpy_orig+0xcd/0x130\nRSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202\nRAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f\nRDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000\nRBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572\nR10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff\nR13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af\nFS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x1a/0x60\n ? page_fault_oops+0x183/0x510\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? memcpy_orig+0xcd/0x130\n vsnprintf+0x102/0x4c0\n sprintf+0x51/0x80\n qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]\n full_proxy_read+0x50/0x80\n vfs_read+0xa5/0x2e0\n ? folio_add_new_anon_rmap+0x44/0xa0\n ? set_pte_at+0x15/0x30\n ? do_pte_missing+0x426/0x7f0\n ksys_read+0xa5/0xe0\n do_syscall_64+0x58/0x80\n ? __count_memcg_events+0x46/0x90\n ? count_memcg_event_mm+0x3d/0x60\n ? handle_mm_fault+0x196/0x2f0\n ? do_user_addr_fault+0x267/0x890\n ? exc_page_fault+0x69/0x150\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4800f20b4d"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:23:31.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56bec63a7fc87ad50b3373a87517dc9770eef9e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/21c963de2e86e88f6a8ca556bcebb8e62ab8e901"
        },
        {
          "url": "https://git.kernel.org/stable/c/144d76a676b630e321556965011b00e2de0b40a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/397a8990c377ee4b61d6df768e61dff9e316d46b"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaddb86637669f6bad89245ee63f8fb2bfb50241"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa85b016a56b9775a3fe41e5d26e666945963b46"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f433ea7d0ff77998766a088a287337fb43ad75"
        },
        {
          "url": "https://git.kernel.org/stable/c/28027ec8e32ecbadcd67623edb290dad61e735b5"
        }
      ],
      "title": "scsi: qedi: Fix crash while reading debugfs attribute",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40978",
    "datePublished": "2024-07-12T12:32:14.149Z",
    "dateReserved": "2024-07-12T12:17:45.604Z",
    "dateUpdated": "2026-05-12T11:56:01.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-41090 (GCVE-0-2024-41090)

Vulnerability from cvelistv5 – Published: 2024-07-29 06:18 – Updated: 2026-08-05 11:35

Title

tap: add missing verification for short frame

Summary

In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:24 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/8be915fc5ff9a5e29…
https://git.kernel.org/stable/c/7431144b406ae8280…
https://git.kernel.org/stable/c/e5e5e63c506b93b89…
https://git.kernel.org/stable/c/ee93e6da30377cf2a…
https://git.kernel.org/stable/c/aa6a5704cab861c9b…
https://git.kernel.org/stable/c/73d462a38d5f782b7…
https://git.kernel.org/stable/c/e1a786b9bbb767fd1…
https://git.kernel.org/stable/c/ed7f2afdd0e043a39…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 8be915fc5ff9a5e296f6538be12ea75a1a93bdea (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 7431144b406ae82807eb87d8c98e518475b0450f (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < e5e5e63c506b93b89b01f522b6a7343585f784e6 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < ee93e6da30377cf2a75e16cd32bb9fcd86a61c46 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < aa6a5704cab861c9b2ae9f475076e1881e87f5aa (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 73d462a38d5f782b7c872fe9ae8393d9ef5483da (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < e1a786b9bbb767fd1c922d424aaa8078cc542309 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < ed7f2afdd0e043a397677e597ced0830b83ba0b3 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.281 , ≤ 5.4.* (semver) Unaffected: 5.10.223 , ≤ 5.10.* (semver) Unaffected: 5.15.164 , ≤ 5.15.* (semver) Unaffected: 6.1.102 , ≤ 6.1.* (semver) Unaffected: 6.6.43 , ≤ 6.6.* (semver) Unaffected: 6.9.12 , ≤ 6.9.* (semver) Unaffected: 6.10.2 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:46.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:59.280166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:06.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8be915fc5ff9a5e296f6538be12ea75a1a93bdea",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "7431144b406ae82807eb87d8c98e518475b0450f",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e5e5e63c506b93b89b01f522b6a7343585f784e6",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ee93e6da30377cf2a75e16cd32bb9fcd86a61c46",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "aa6a5704cab861c9b2ae9f475076e1881e87f5aa",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "73d462a38d5f782b7c872fe9ae8393d9ef5483da",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e1a786b9bbb767fd1c922d424aaa8078cc542309",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ed7f2afdd0e043a397677e597ced0830b83ba0b3",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.281",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.102",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.43",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\n\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\n\nCVE: CVE-2024-41090"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through vhost-net\u0027s batched XDP TX path, driven either by a guest VM\u0027s TX virtqueue on the same host or by a local process holding /dev/vhost-net plus a macvtap/ipvtap fd. Data arrives via shared memory rings, not from a remote network peer, so this is local rather than network access.\nAC:L - The attacker simply posts a TX descriptor whose payload is shorter than 14 bytes and kicks the virtqueue; vhost_net_build_xdp() only rejects len \u003c sock_hlen, so the short frame reaches tap_get_user_xdp() deterministically. The XDP batch path is active in the default QEMU configuration (unlimited sndbuf), and can be retried indefinitely.\nPR:L - The attacker must be an authorized guest VM on the host, or a local user with access to /dev/vhost-net and a tap/macvtap character device \u2014 some privilege, but nothing resembling host root. No CAP_SYS_ADMIN or init-namespace root is needed to trigger the path.\nUI:N - The malformed frame is processed entirely by the vhost worker kthread as soon as the guest kicks the ring; no host administrator or victim action is involved.\nS:C - A guest VM with zero host privileges corrupts host-kernel skb state and leaks host heap contents, crossing the guest/host virtualization boundary; the impacted resources (host kernel, physical NIC path, peer macvtap interfaces belonging to other tenants) lie outside the attacking guest\u0027s security authority.\nC:H - skb-\u003eprotocol is populated from eth_hdr() bytes that were never copied from the guest, exposing uninitialized page_frag memory that can contain remnants of previously transmitted host/other-guest packets, and the sub-ETH_HLEN skb causes downstream code to read beyond the actual frame length. The resulting memory-disclosure primitive is not bounded to a trivial value.\nI:H - A corrupted skb with network_header pointing past skb-\u003etail is passed to dev_queue_xmit(), so lower-layer drivers and offload code compute header lengths that underflow to enormous unsigned values, yielding out-of-bounds accesses and DMA/copy lengths attacker-influencing kernel memory. Such skb metadata corruption is leverageable for control-flow-relevant memory corruption.\nA:H - The out-of-bounds accesses and inconsistent header offsets in downstream network drivers readily produce a kernel oops or panic on the host, and the guest can repeat the trigger at will to keep the host down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:18.598Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
        }
      ],
      "title": "tap: add missing verification for short frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41090",
    "datePublished": "2024-07-29T06:18:10.896Z",
    "dateReserved": "2024-07-12T12:17:45.635Z",
    "dateUpdated": "2026-08-05T11:35:18.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-41091 (GCVE-0-2024-41091)

Vulnerability from cvelistv5 – Published: 2024-07-29 06:18 – Updated: 2026-08-05 11:35

Title

tun: add missing verification for short frame

Summary

In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP. This is to drop any frame shorter than the Ethernet header size just like how tun_get_user() does. CVE: CVE-2024-41091

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:24 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/32b0aaba5dbc85816…
https://git.kernel.org/stable/c/6100e023720489026…
https://git.kernel.org/stable/c/589382f50b4a5d90d…
https://git.kernel.org/stable/c/ad6b3f622ccfb4bfe…
https://git.kernel.org/stable/c/d5ad89b7d01ed4e66…
https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5…
https://git.kernel.org/stable/c/8418f55302fa1d2ee…
https://git.kernel.org/stable/c/049584807f1d797fc…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 32b0aaba5dbc85816898167d9b5d45a22eae82e9 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 6100e0237204890269e3f934acfc50d35fd6f319 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < d5ad89b7d01ed4e66fd04734fc63d6e78536692a (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 8418f55302fa1d2eeb73e16e345167e545c598a5 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 049584807f1d797fc3078b68035450a9769eb5c3 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.281 , ≤ 5.4.* (semver) Unaffected: 5.10.223 , ≤ 5.10.* (semver) Unaffected: 5.15.164 , ≤ 5.15.* (semver) Unaffected: 6.1.102 , ≤ 6.1.* (semver) Unaffected: 6.6.43 , ≤ 6.6.* (semver) Unaffected: 6.9.12 , ≤ 6.9.* (semver) Unaffected: 6.10.2 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:47.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41091",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:56.109252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:06.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32b0aaba5dbc85816898167d9b5d45a22eae82e9",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "6100e0237204890269e3f934acfc50d35fd6f319",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "8418f55302fa1d2eeb73e16e345167e545c598a5",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "049584807f1d797fc3078b68035450a9769eb5c3",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.281",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.102",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.43",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tun_xdp_one() path, which could cause a corrupted skb to be sent\ndownstack. Even before the skb is transmitted, the\ntun_xdp_one--\u003eeth_type_trans() may access the Ethernet header although it\ncan be less than ETH_HLEN. Once transmitted, this could either cause\nout-of-bound access beyond the actual length, or confuse the underlayer\nwith incorrect or inconsistent header length in the skb metadata.\n\nIn the alternative path, tun_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted for\nIFF_TAP.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tun_get_user() does.\n\nCVE: CVE-2024-41091"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reachable through the vhost-net TX ring driven by a local vhost_net file descriptor (or the guest attached to it), not through any network protocol handler; the attacker needs local access to /dev/vhost-net plus a tap backend, or local access inside a VM whose virtio-net device is backed by vhost-net.\nAC:L - Triggering is a single deterministic action \u2014 post a TX descriptor whose length equals sock_hlen so datasize is 0 \u2014 on the default configuration (sk_sndbuf == INT_MAX enables the batch XDP path, zerocopy TX is off by default); no race, no timing window, no memory-layout precondition.\nPR:L - No capability check exists anywhere in drivers/vhost, so opening /dev/vhost-net needs only file permissions (kvm group on typical hosts), and TUNSETIFF\u0027s ns_capable(CAP_NET_ADMIN) is trivially obtained via unshare -Urn; in the KVM scenario the attacker holds only guest-side privileges and none on the host.\nUI:N - The attacker drives the entire sequence \u2014 creating the tap, binding the vhost backend, and kicking the virtqueue \u2014 with no action required from any other user; a malicious guest needs only its own already-configured virtio-net device.\nS:C - In the standard KVM deployment, vhost-net/tun is the host-kernel component enforcing the guest\u0027s confinement to its virtual NIC, and a guest-supplied short frame corrupts host kernel memory and injects a malformed skb into the host\u0027s network stack, bridge and physical NIC \u2014 resources outside the guest\u0027s security authority, i.e. a guest-to-host boundary crossing.\nC:H - eth_skb_pull_mac()/eth_skb_pkt_type() dereference the Ethernet header past the end of the valid data, reading stale page-frag heap contents, and the resulting skb carries a length shorter than the headers it claims, so downstream forwarding onto a bridge or physical NIC can transmit adjacent kernel heap bytes and the unbounded downstream over-reads the commit warns about.\nI:H - A corrupted skb with inconsistent length/header metadata is passed into netif_receive_skb() and on through the host stack, where unsigned header-length arithmetic on skb-\u003elen \u003c ETH_HLEN underflows and yields out-of-bounds accesses \u2014 memory corruption of this class is leveragable into write primitives and control-flow hijacking.\nA:H - The out-of-bounds access and the malformed skb entering the host network stack readily produce a host kernel oops or panic, and the trigger can be repeated at packet rate from an unprivileged guest, denying service to the host and every other guest on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:19.663Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319"
        },
        {
          "url": "https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3"
        }
      ],
      "title": "tun: add missing verification for short frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41091",
    "datePublished": "2024-07-29T06:18:12.019Z",
    "dateReserved": "2024-07-12T12:17:45.636Z",
    "dateUpdated": "2026-08-05T11:35:19.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2024_5257

CVE-2024-35898 (GCVE-0-2024-35898)

CVE-2024-36886 (GCVE-0-2024-36886)

CVE-2024-36971 (GCVE-0-2024-36971)

CVE-2024-39502 (GCVE-0-2024-39502)

CVE-2024-40978 (GCVE-0-2024-40978)

CVE-2024-41090 (GCVE-0-2024-41090)

CVE-2024-41091 (GCVE-0-2024-41091)

Tags

Sightings

Nomenclature