CVE-2024-50036

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-50036", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.070Z", "datePublished": "2024-10-21T19:39:37.135Z", "dateUpdated": "2026-08-05T11:41:09.713Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:09.713Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n dst_release_immediate(child), this might also cause UAF\n if the child does not have DST_NOCOUNT set.\n IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n which might happen in future kernels."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The trigger is network-namespace dismantle \u2014 a local operation (`unshare -Urn` then exit, or `ip netns del`) that drives `cleanup_net()` \u2192 `ip6_route_net_exit()`; a remote peer can populate the counted IPv6 dsts but cannot cause the teardown itself.\nAC:L - The attacker controls both sides \u2014 it creates the counted dsts and triggers the teardown \u2014 and the \"race\" is structurally biased in the attacker's favor since `fib6_net_exit()`'s `dst_release()` calls precede `ip6_route_net_exit()` by microseconds while the deferred `dst_destroy()` waits a full RCU grace period; automated CI hit it accidentally, and the loop can be repeated indefinitely.\nPR:L - An unprivileged local user obtains CAP_NET_ADMIN in a private netns via user namespaces (`unshare -Urn`, enabled by default on Debian/Ubuntu/Fedora and inherent to container runtimes), which is sufficient to create the IPv6 dsts and destroy the namespace; no real root is needed.\nUI:N - The attacker performs every step itself \u2014 namespace creation, IPv6 traffic/exception-route generation, and namespace teardown \u2014 with no victim action required.\nS:U - The freed per-cpu memory and the resulting corruption are kernel objects within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free: `percpu_counter_add_batch()` reads `this_cpu_read(*fbc->counters)` from `free_percpu()`'d memory that another subsystem has since reallocated, and the slow path folds that stolen value into `fbc->count`, which is observable via `dst_entries_get_slow()`; escalating the per-cpu `percpu_ref` decrement to a real object UAF yields arbitrary kernel read.\nI:H - The same code path performs a `this_cpu_try_cmpxchg` **write** into the freed/reallocated per-cpu slot \u2014 a groomable, repeatable decrement primitive on arbitrary per-cpu state \u2014 and once `fbc->counters` is NULLed it writes at per-cpu offset 0, corrupting `pcpu_hot.current_task` on x86_64, which is directly leveragable for control-flow hijack and privilege escalation.\nA:H - The reported failure is a KASAN use-after-free splat during netns dismantle, and corrupting freed per-cpu memory or the `current_task` pointer reliably produces an oops/panic; the teardown loop can be repeated at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/dst.c"], "versions": [{"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "547087307bc19417b4f2bc85ba9664a3e8db5a6a", "status": "affected", "versionType": "git"}, {"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "e3915f028b1f1c37e87542e5aadd33728c259d96", "status": "affected", "versionType": "git"}, {"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "a60db84f772fc3a906c6c4072f9207579c41166f", "status": "affected", "versionType": "git"}, {"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "eae7435b48ffc8e9be0ff9cfeae40af479a609dd", "status": "affected", "versionType": "git"}, {"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "3c7c918ec0aa3555372c5a57f18780b7a96c5cfc", "status": "affected", "versionType": "git"}, {"version": "f88649721268999bdff09777847080a52004f691", "lessThan": "ac888d58869bb99753e7652be19a151df9ecb35d", "status": "affected", "versionType": "git"}, {"version": "86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41", "status": "affected", "versionType": "git"}, {"version": "591b1e1bb40152e22cee757f493046a0ca946bf8", "status": "affected", "versionType": "git"}, {"version": "df90819dafcd6b97fc665f63a15752a570e227a2", "status": "affected", "versionType": "git"}, {"version": "9a4fe697023dbe6c25caa1f8b2153af869a29bd2", "status": "affected", "versionType": "git"}, {"version": "3.10.50", "lessThan": "3.11", "status": "affected", "versionType": "semver"}, {"version": "3.12.26", "lessThan": "3.13", "status": "affected", "versionType": "semver"}, {"version": "3.14.14", "lessThan": "3.15", "status": "affected", "versionType": "semver"}, {"version": "3.15.7", "lessThan": "3.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/dst.c"], "versions": [{"version": "3.16", "status": "affected"}, {"version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.230", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.172", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.117", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.10.230"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.15.172"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.11.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a"}, {"url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96"}, {"url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f"}, {"url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd"}, {"url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc"}, {"url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d"}], "title": "net: do not delay dst_entries_add() in dst_release()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50036", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:25:25.259782Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:28:44.921Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:42.427Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:42.427Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50036", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:25:25.259782Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:25:28.324Z"}}], "cna": {"title": "net: do not delay dst_entries_add() in dst_release()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "547087307bc19417b4f2bc85ba9664a3e8db5a6a", "versionType": "git"}, {"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "e3915f028b1f1c37e87542e5aadd33728c259d96", "versionType": "git"}, {"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "a60db84f772fc3a906c6c4072f9207579c41166f", "versionType": "git"}, {"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "eae7435b48ffc8e9be0ff9cfeae40af479a609dd", "versionType": "git"}, {"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "3c7c918ec0aa3555372c5a57f18780b7a96c5cfc", "versionType": "git"}, {"status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "lessThan": "ac888d58869bb99753e7652be19a151df9ecb35d", "versionType": "git"}, {"status": "affected", "version": "86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41", "versionType": "git"}, {"status": "affected", "version": "591b1e1bb40152e22cee757f493046a0ca946bf8", "versionType": "git"}, {"status": "affected", "version": "df90819dafcd6b97fc665f63a15752a570e227a2", "versionType": "git"}, {"status": "affected", "version": "9a4fe697023dbe6c25caa1f8b2153af869a29bd2", "versionType": "git"}, {"status": "affected", "version": "3.10.50", "lessThan": "3.11", "versionType": "semver"}, {"status": "affected", "version": "3.12.26", "lessThan": "3.13", "versionType": "semver"}, {"status": "affected", "version": "3.14.14", "lessThan": "3.15", "versionType": "semver"}, {"status": "affected", "version": "3.15.7", "lessThan": "3.16", "versionType": "semver"}], "programFiles": ["net/core/dst.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"status": "unaffected", "version": "0", "lessThan": "3.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.230", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.172", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.117", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.57", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.4", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/dst.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a"}, {"url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96"}, {"url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f"}, {"url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd"}, {"url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc"}, {"url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n dst_release_immediate(child), this might also cause UAF\n if the child does not have DST_NOCOUNT set.\n IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n which might happen in future kernels."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.230", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.172", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.117", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.57", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.4", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.10.50"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.12.26"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.14.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.15.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:54:16.288Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50036", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:54:16.288Z", "dateReserved": "2024-10-21T12:17:06.070Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T19:39:37.135Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/dst.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "547087307bc19417b4f2bc85ba9664a3e8db5a6a", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"lessThan": "e3915f028b1f1c37e87542e5aadd33728c259d96", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"lessThan": "a60db84f772fc3a906c6c4072f9207579c41166f", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"lessThan": "eae7435b48ffc8e9be0ff9cfeae40af479a609dd", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"lessThan": "3c7c918ec0aa3555372c5a57f18780b7a96c5cfc", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"lessThan": "ac888d58869bb99753e7652be19a151df9ecb35d", "status": "affected", "version": "f88649721268999bdff09777847080a52004f691", "versionType": "git"}, {"status": "affected", "version": "86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41", "versionType": "git"}, {"status": "affected", "version": "591b1e1bb40152e22cee757f493046a0ca946bf8", "versionType": "git"}, {"status": "affected", "version": "df90819dafcd6b97fc665f63a15752a570e227a2", "versionType": "git"}, {"status": "affected", "version": "9a4fe697023dbe6c25caa1f8b2153af869a29bd2", "versionType": "git"}, {"lessThan": "3.11", "status": "affected", "version": "3.10.50", "versionType": "semver"}, {"lessThan": "3.13", "status": "affected", "version": "3.12.26", "versionType": "semver"}, {"lessThan": "3.15", "status": "affected", "version": "3.14.14", "versionType": "semver"}, {"lessThan": "3.16", "status": "affected", "version": "3.15.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/dst.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"lessThan": "3.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.230", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.172", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.117", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.57", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB008871-978A-402A-8407-15291079DC44", "versionEndExcluding": "3.11", "versionStartIncluding": "3.10.50", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "597B9ABF-E2FF-405B-8226-0BD990181032", "versionEndExcluding": "3.13", "versionStartIncluding": "3.12.26", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6241E34F-0DAB-4BE0-AD33-1BEEDA5841C9", "versionEndExcluding": "3.15", "versionStartIncluding": "3.14.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F88CDBE1-4ECE-4BE4-B2A6-7E814D3EA822", "versionEndExcluding": "3.16", "versionStartIncluding": "3.15.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D4764C3-4502-4F9B-8704-85262723C867", "versionEndExcluding": "6.6.57", "versionStartIncluding": "3.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA84D336-CE9A-4535-B901-1AD77EC17C34", "versionEndExcluding": "6.11.4", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*", "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n dst_release_immediate(child), this might also cause UAF\n if the child does not have DST_NOCOUNT set.\n IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n which might happen in future kernels."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no retrasar dst_entries_add() en dst_release() dst_entries_add() usa datos por CPU que podr\u00edan liberarse en el desmantelamiento de netns de ip6_route_net_exit() llamando a dst_entries_destroy() Antes de que se pueda llamar a ip6_route_net_exit(), liberamos todos los dst asociados con este netns, a trav\u00e9s de llamadas a dst_release(), que espera un per\u00edodo de gracia de rcu antes de llamar a dst_destroy() El uso de dst_entries_add() en dst_destroy() es arriesgado, porque dst_entries_destroy() ya podr\u00eda haberse llamado. La disminuci\u00f3n del n\u00famero de dst debe ocurrir antes. Notas: 1) en el caso de CONFIG_XFRM, dst_destroy() puede llamar a dst_release_immediate(child), lo que tambi\u00e9n podr\u00eda causar UAF si el hijo no tiene DST_NOCOUNT configurado. Los encargados del mantenimiento de IPSEC podr\u00edan echar un vistazo y ver c\u00f3mo solucionar esto. 2) Tambi\u00e9n se est\u00e1 discutiendo sobre la eliminaci\u00f3n de este recuento de dst, lo que podr\u00eda suceder en kernels futuros."}], "id": "CVE-2024-50036", "lastModified": "2026-08-04T11:21:10.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50036", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:25:25.259782Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:16.717", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: do not delay dst_entries_add() in dst_release()", "id": "2320622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320622"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: do not delay dst_entries_add() in dst_release()\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\nDecrementing the number of dsts must happen sooner.\nNotes:\n1) in CONFIG_XFRM case, dst_destroy() can call\ndst_release_immediate(child), this might also cause UAF\nif the child does not have DST_NOCOUNT set.\nIPSEC maintainers might take a look and see how to address this.\n2) There is also discussion about removing this count of dst,\nwhich might happen in future kernels."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-50036", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50036\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50036\nhttps://lore.kernel.org/linux-cve-announce/2024102132-CVE-2024-50036-9d91@gregkh/T"], "statement": "The bug happens during sending packets and routing decision (as result of complex race condition). Only local user can potentially trigger it.", "threat_severity": "Moderate"}

{}