Skip to content
Log inStart free trial

CVE-2024-36971 A-343727534 ASB-A-343727534

net: fix __dst_negative_advice() race

High Known exploited Linux
Severity
7.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
2.70%
Chance of exploitation in the next 30 days. Higher than 85.94% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Aug 7, 2024
Weakness
CWE-416 Use After Free
Fix
6.9.4
Upgrade Kernel to this version or later
Exploited in the wild. Android Kernel Remote Code Execution Vulnerability (Android Kernel). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Aug 28, 2024.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix __dst_negative_advice() race

__dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.

Affected versions

Linux

PackageVulnerableFixed in
Kernel
>= 4.6.0, < 4.19.316
>= 4.20.0, < 5.4.278
>= 5.5.0, < 5.10.219
>= 5.11.0, < 5.15.161
>= 5.16.0, < 6.1.94
>= 6.2.0, < 6.6.34
>= 6.7.0, < 6.9.4
4.19.316
5.4.278
5.10.219
5.15.161
6.1.94
6.6.34
6.9.4

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

Kernel Linux → 6.9.4

Set Kernel to 6.9.4 or later in your manifest.

Severity breakdown

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it
  • Architecture and Design: Choose a language that provides automatic memory management.
  • Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
High Known exploited Also affects Kernel
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
High Known exploited Also affects Kernel
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
High Known exploited Also affects Kernel
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
High Known exploited Also affects Kernel
CVE-2025-39964
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Medium Known exploited Also affects Kernel
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Critical Known exploited Also affects Kernel
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
High Known exploited Also affects Kernel
CVE-2024-53197
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
High Known exploited Also affects Kernel
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor