PT-2024-5946 · Linux+7 · Linux Kernel+7
Eric Dumazet
·
Published
2024-08-21
·
Updated
2026-03-14
·
CVE-2024-44986
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
The issue is related to the use of memory after it has been freed in the ip6 finish output2 function of the Linux kernel. This can lead to a denial of service. The problem occurs when skb expand head() returns NULL, indicating that the skb has been freed, and the associated dst/idev could also have been freed. To prevent this, it is necessary to hold rcu read lock() to ensure that the dst and associated idev are alive.
Recommendations
To resolve the issue, update to Linux kernel version 6.6.50 or later.
As a temporary workaround, consider restricting access to the ip6 finish output2 function until a patch is available.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu