PT-2024-31348 · Linux+10 · Linux Kernel+10
Nikolay Aleksandrov
·
Published
2024-08-20
·
Updated
2025-09-29
·
CVE-2024-44989
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
A vulnerability has been resolved in the Linux kernel, specifically in the bonding module, where a null pointer dereference could occur when setting
real dev to NULL while packets are in transit and xfrm might call xdo dev offload ok() in parallel. All callbacks assume real dev is set. This issue can lead to a page fault and potentially cause the system to crash.Recommendations
To resolve this issue, update the Linux kernel to version 6.6.50 or later. If updating is not possible, consider disabling the bonding module or restricting its use until an update can be applied.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu