CVE-2024-36971net: fix __dst_negative_advice() race
- 7.8HighCVSS base score
- 2.7%Exploitation in 30 daysEPSS · top 14% of all CVEs
- YesKnown exploitedin CISA's KEV since 7 Aug 2024
- YesPublic exploitsa reference or SSVC says so
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Android Kernel Remote Code Execution Vulnerability.
- Added
- 7 Aug 2024
- Fix due (US federal)
- 28 Aug 2024
- Used by ransomware
- Not known
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 7 Aug 2024.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 58 days later
· 58 days later
Added to CISA KEV
Known exploited in the wild
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CISA-ADPADP (enrichment) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.7% · top 14% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < db0082825037794c5dba9959c9de13ca34cc5e72
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < 2295a7ef5c8c49241bff769e7826ef2582e532a6
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < eacb8b195579c174a6d3e12a9690b206eb7f28cf
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < 81dd3c82a456b0015461754be7cb2693991421b4
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < 5af198c387128a9d2ddd620b0f0803564a4d4508
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < b8af8e6118a6605f0e495a58d591ca94a85a50fc
- affected a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 – < 92f1655aa2b2294d0b49925f3b875a634bd3b59e
- affected 4.6
- unaffected < 4.6
- unaffected 4.19.316 – ≤ 4.19.*
- unaffected 5.4.278 – ≤ 5.4.*
- unaffected 5.10.219 – ≤ 5.10.*
- unaffected 5.15.161 – ≤ 5.15.*
- unaffected 6.1.94 – ≤ 6.1.*
- unaffected 6.6.34 – ≤ 6.6.*
- unaffected 6.9.4 – ≤ 6.9.*
- unaffected 6.10 – ≤ *
References
References10
- https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html (opens in a new tab)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-36321 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-36971)Record last updated .