CVE-2024-46845 (GCVE-0-2024-46845)

Vulnerability from cvelistv5 – Published: 2024-09-27 12:39 – Updated: 2026-08-05 11:38
VLAI
Title
tracing/timerlat: Only clear timer if a kthread exists
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug. Only cancel the hrtimer if the associated thread is still around. Also add the interface_lock around the resetting of the tlat_var->kthread. Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 8a9d0d405159e9c796ddf771f7cff691c1a2bc1e (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < e6a53481da292d970d1edf0d8831121d1c5e2f0d (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:59:07.271021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:59:12.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "8a9d0d405159e9c796ddf771f7cff691c1a2bc1e",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "e6a53481da292d970d1edf0d8831121d1c5e2f0d",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Only clear timer if a kthread exists\n\nThe timerlat tracer can use user space threads to check for osnoise and\ntimer latency. If the program using this is killed via a SIGTERM, the\nthreads are shutdown one at a time and another tracing instance can start\nup resetting the threads before they are fully closed. That causes the\nhrtimer assigned to the kthread to be shutdown and freed twice when the\ndying thread finally closes the file descriptors, causing a use-after-free\nbug.\n\nOnly cancel the hrtimer if the associated thread is still around. Also add\nthe interface_lock around the resetting of the tlat_var-\u003ekthread.\n\nNote, this is just a quick fix that can be backported to stable. A real\nfix is to have a better synchronization between the shutdown of old\nthreads and the starting of new ones."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local file operations on tracefs (`open`/`read`/`close` on `osnoise/per_cpu/cpuN/timerlat_fd` plus writes to `current_tracer` and `osnoise/options`). There is no network or remote-peer input involved.\nAC:L - The attacker controls both sides of the race \u2014 they terminate their own timerlat user threads (which close fds one at a time, giving a wide window) while concurrently starting a second timerlat instance that memsets the still-armed per-cpu hrtimers, and can retry the loop indefinitely. CONFIG_TIMERLAT_TRACER is enabled in mainstream distro kernels, so no rare configuration is required.\nPR:L - Default tracefs permissions are root-only, but tracefs explicitly supports `uid=`/`gid=`/`mode=` mount options and it is common practice (Android tracing group, developer/CI/RT-tuning hosts, tracing sidecar containers with /sys/kernel/tracing mounted rw) to grant an unprivileged user or group full tracing access so rtla/trace-cmd can run without root; in that reasonable deployment a basic local user performs the whole sequence.\nUI:N - The attacker performs every step themselves \u2014 enabling the tracer, opening the per-cpu timerlat fds, killing the threads, and restarting a second instance. No victim action is needed.\nS:U - The corruption is confined to kernel hrtimer state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The bug is an upstream-acknowledged use-after-free on an hrtimer that remains enqueued in the per-CPU hrtimer_clock_base rb-tree after being zeroed and re-initialized, giving corruption of timer-subsystem structures that can be groomed into arbitrary kernel-memory reads.\nI:H - A stale rb-node left in the hrtimer timerqueue with zeroed links causes subsequent `rb_insert_color`/`rb_erase` operations to write through attacker-influenceable pointers, and the freed/re-initialized timer\u0027s `function` field is a call target \u2014 a write and control-flow-hijack primitive.\nA:H - Even without full exploitation the bug reliably crashes the kernel: `hrtimer_cancel()` dereferences a NULL `timer-\u003ebase`, and the next hrtimer interrupt dequeues the zeroed node and calls a NULL `timer-\u003efunction` in hardirq context, panicking the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:57.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d"
        }
      ],
      "title": "tracing/timerlat: Only clear timer if a kthread exists",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46845",
    "datePublished": "2024-09-27T12:39:38.315Z",
    "dateReserved": "2024-09-11T15:12:18.289Z",
    "dateUpdated": "2026-08-05T11:38:57.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46845",
      "date": "2026-08-08",
      "epss": "0.00237",
      "percentile": "0.14757"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:11:29.000Z",
      "cve": "CVE-2024-46845",
      "id": "msrc_CVE-2024-46845",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing/timerlat: Only clear timer if a kthread exists",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46845.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46845\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-27T13:15:16.397\",\"lastModified\":\"2026-06-17T07:56:04.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Only clear timer if a kthread exists\\n\\nThe timerlat tracer can use user space threads to check for osnoise and\\ntimer latency. If the program using this is killed via a SIGTERM, the\\nthreads are shutdown one at a time and another tracing instance can start\\nup resetting the threads before they are fully closed. That causes the\\nhrtimer assigned to the kthread to be shutdown and freed twice when the\\ndying thread finally closes the file descriptors, causing a use-after-free\\nbug.\\n\\nOnly cancel the hrtimer if the associated thread is still around. Also add\\nthe interface_lock around the resetting of the tlat_var-\u003ekthread.\\n\\nNote, this is just a quick fix that can be backported to stable. A real\\nfix is to have a better synchronization between the shutdown of old\\nthreads and the starting of new ones.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/timerlat: Solo borra el temporizador si existe un kthread El tracer timerlat puede usar subprocesos del espacio de usuario para verificar el ruido de os y la latencia del temporizador. Si el programa que lo usa se elimina mediante un SIGTERM, los subprocesos se cierran uno a la vez y otra instancia de tracer puede comenzar a reiniciar los subprocesos antes de que se cierren por completo. Eso hace que el hrtimer asignado al kthread se cierre y se libere dos veces cuando el subproceso que muere finalmente cierra los descriptores de archivo, lo que causa un error de uso despu\u00e9s de liberaci\u00f3n. Solo cancele el hrtimer si el subproceso asociado a\u00fan est\u00e1 presente. Tambi\u00e9n agregue el interface_lock alrededor del reinicio de tlat_var-\u0026gt;kthread. Tenga en cuenta que esto es solo una soluci\u00f3n r\u00e1pida que se puede trasladar a estable. Una soluci\u00f3n real es tener una mejor sincronizaci\u00f3n entre el apagado de subprocesos antiguos y el inicio de nuevos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"e6a53481da292d970d1edf0d8831121d1c5e2f0d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T13:59:07.271021Z\",\"id\":\"CVE-2024-46845\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"68960B54-63EE-43D7-A875-28E3ECFA945B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:42+00:00",
      "cve": "CVE-2024-46845",
      "id": "CVE-2024-46845",
      "initial_release_date": "2024-09-27T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/timerlat: Only clear timer if a kthread exists",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46845.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:59:07.271021Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:59:08.464Z\"}}], \"cna\": {\"title\": \"tracing/timerlat: Only clear timer if a kthread exists\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"e6a53481da292d970d1edf0d8831121d1c5e2f0d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\"}, {\"url\": \"https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\"}, {\"url\": \"https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Only clear timer if a kthread exists\\n\\nThe timerlat tracer can use user space threads to check for osnoise and\\ntimer latency. If the program using this is killed via a SIGTERM, the\\nthreads are shutdown one at a time and another tracing instance can start\\nup resetting the threads before they are fully closed. That causes the\\nhrtimer assigned to the kthread to be shutdown and freed twice when the\\ndying thread finally closes the file descriptors, causing a use-after-free\\nbug.\\n\\nOnly cancel the hrtimer if the associated thread is still around. Also add\\nthe interface_lock around the resetting of the tlat_var-\u003ekthread.\\n\\nNote, this is just a quick fix that can be backported to stable. A real\\nfix is to have a better synchronization between the shutdown of old\\nthreads and the starting of new ones.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:35:47.670Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:35:47.670Z\", \"dateReserved\": \"2024-09-11T15:12:18.289Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:39:38.315Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.