Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-39503netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. The patch contains the following parts: - When destroying all sets, first remove the garbage collectors, then wait if needed and then destroy the sets. - Fix the badly ordered "wait then remove gc" for the destroy a single set case. - Fix the missing rcu locking in the list:set type in the userspace test case. - Use proper RCU list handlings in the list:set type. The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).

Timeline

  1. ID reserved

    By Linux

  2. · 17 days later

    Published

  3. · 2 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-39503, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.22% · top 87% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • Linux · Linux

    • affected c7f2733e5011bfd136f1ca93497394d43aa76225 – < c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3
    • affected a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 – < 93b53c202b51a69e42ca57f5a183f7e008e19f83
    • affected c2dc077d8f722a1c73a24e674f925602ee5ece49 – < 0f1bb77c6d837c9513943bc7c08f04c5cc5c6568
    • affected 653bc5e6d9995d7d5f497c665b321875a626161c – < 390b353d1a1da3e9c6c0fd14fe650d69063c95d6
    • affected b93a6756a01f4fd2f329a39216f9824c56a66397 – < 2ba35b37f780c6410bb4bba9c3072596d8576702
    • affected 97f7cf1cd80eeed3b7c808b7c12463295c751001 – < 90ae20d47de602198eb69e6cd7a3db3420abfc08
    • affected 97f7cf1cd80eeed3b7c808b7c12463295c751001 – < 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10
    • affected 970709a67696b100a57b33af1a3d75fc34b747eb
    • affected 5.4.269 – < 5.4.279
    • affected 5.10.210 – < 5.10.221
    • affected 5.15.149 – < 5.15.162
    • affected 6.1.79 – < 6.1.95
    • affected 6.6.18 – < 6.6.35
    • affected 6.7.6 – < 6.8

  • Linux · Linux

    • affected 6.8
    • unaffected < 6.8
    • unaffected 5.4.279 – ≤ 5.4.*
    • unaffected 5.10.221 – ≤ 5.10.*
    • unaffected 5.15.162 – ≤ 5.15.*
    • unaffected 6.1.95 – ≤ 6.1.*
    • unaffected 6.6.35 – ≤ 6.6.*
    • unaffected 6.9.6 – ≤ 6.9.*
    • unaffected 6.10 – ≤ *

References

References11

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-39503 badge
[![CVE-2024-39503](https://cveledger.app/badge/CVE-2024-39503.svg)](https://cveledger.app/cve/CVE-2024-39503)

Record last updated .