CVE-2024-36971 — Kernel
HIGHCVE-2024-36971 is a high-severity (CVSS 7.8) Use After Free vulnerability in Kernel. It is in CISA's Known Exploited Vulnerabilities catalog (added 2024-08-07) — treat it as actively exploited and patch now. A fix is available for Kernel — see the affected versions and patch details below.
net: fix __dst_negative_advice() race
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2024-08-07. Federal agencies were required to remediate by 2024-08-28.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2024-36971.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2024-36971 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
KernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Linux packages — download data is not available via public APIs for these ecosystems.
Description
In the Linux kernel, the following vulnerability has been resolved:
net: fix __dst_negative_advice() race
__dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves.
Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐧Linux | Kernel | ≥ 4.6.0&&< 4.19.316 | 4.19.316 |
Affected Products
debian linuxdebianlinux kernellinuxResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Kernel to 4.19.316 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-36971 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Environments which use third-party KABI modules may experience kernel crashes after applying errata for CVE-2024-36971. Contact your module vendor about an update. Until these third party modules can be fixed, you can prevent crashes by disabling them. This problem stems from modules which use the `negative_advice()`…
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.Source: Red Hat security advisory for CVE-2024-36971 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 7.7 Advanced Update Support | kernel-0:3.10.0-1062.90.1.el7 | RHSA-2024:5261 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel-0:3.10.0-1160.123.1.el7 | RHSA-2024:5259 |
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10 | RHSA-2024:5102 |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-553.16.1.el8_10 | RHSA-2024:5101 |
| Red Hat Enterprise Linux 8 | kpatch-patch | RHSA-2024:5522 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | kernel-0:4.18.0-193.138.1.el8_2 | RHSA-2024:5388 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | kernel-0:4.18.0-305.138.1.el8_4 | RHSA-2024:5266 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | kernel-rt-0:4.18.0-305.138.1.rt7.214.el8_4 | RHSA-2024:5282 |
Frequently Asked Questions
Is CVE-2024-36971 in your dependencies?
Find it across Linux, including transitive dependencies.