GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50036 (GCVE-0-2024-50036)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
Title
net: do not delay dst_entries_add() in dst_release()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:25 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f88649721268999bdff09777847080a52004f691 , < 547087307bc19417b4f2bc85ba9664a3e8db5a6a (git)
Affected: f88649721268999bdff09777847080a52004f691 , < e3915f028b1f1c37e87542e5aadd33728c259d96 (git)
Affected: f88649721268999bdff09777847080a52004f691 , < a60db84f772fc3a906c6c4072f9207579c41166f (git)
Affected: f88649721268999bdff09777847080a52004f691 , < eae7435b48ffc8e9be0ff9cfeae40af479a609dd (git)
Affected: f88649721268999bdff09777847080a52004f691 , < 3c7c918ec0aa3555372c5a57f18780b7a96c5cfc (git)
Affected: f88649721268999bdff09777847080a52004f691 , < ac888d58869bb99753e7652be19a151df9ecb35d (git)
Affected: 86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41 (git)
Affected: 591b1e1bb40152e22cee757f493046a0ca946bf8 (git)
Affected: df90819dafcd6b97fc665f63a15752a570e227a2 (git)
Affected: 9a4fe697023dbe6c25caa1f8b2153af869a29bd2 (git)
Affected: 3.10.50 , < 3.11 (semver)
Affected: 3.12.26 , < 3.13 (semver)
Affected: 3.14.14 , < 3.15 (semver)
Affected: 3.15.7 , < 3.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 5.10.230 , ≤ 5.10.* (semver)
Unaffected: 5.15.172 , ≤ 5.15.* (semver)
Unaffected: 6.1.117 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:25:25.259782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:44.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:42.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "547087307bc19417b4f2bc85ba9664a3e8db5a6a",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "e3915f028b1f1c37e87542e5aadd33728c259d96",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "a60db84f772fc3a906c6c4072f9207579c41166f",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "eae7435b48ffc8e9be0ff9cfeae40af479a609dd",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "3c7c918ec0aa3555372c5a57f18780b7a96c5cfc",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "lessThan": "ac888d58869bb99753e7652be19a151df9ecb35d",
              "status": "affected",
              "version": "f88649721268999bdff09777847080a52004f691",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "591b1e1bb40152e22cee757f493046a0ca946bf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df90819dafcd6b97fc665f63a15752a570e227a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9a4fe697023dbe6c25caa1f8b2153af869a29bd2",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.50",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.26",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.14",
              "versionType": "semver"
            },
            {
              "lessThan": "3.16",
              "status": "affected",
              "version": "3.15.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dst.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.172",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.15.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n   dst_release_immediate(child), this might also cause UAF\n   if the child does not have DST_NOCOUNT set.\n   IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n   which might happen in future kernels."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is network-namespace dismantle \u2014 a local operation (`unshare -Urn` then exit, or `ip netns del`) that drives `cleanup_net()` \u2192 `ip6_route_net_exit()`; a remote peer can populate the counted IPv6 dsts but cannot cause the teardown itself.\nAC:L - The attacker controls both sides \u2014 it creates the counted dsts and triggers the teardown \u2014 and the \"race\" is structurally biased in the attacker\u0027s favor since `fib6_net_exit()`\u0027s `dst_release()` calls precede `ip6_route_net_exit()` by microseconds while the deferred `dst_destroy()` waits a full RCU grace period; automated CI hit it accidentally, and the loop can be repeated indefinitely.\nPR:L - An unprivileged local user obtains CAP_NET_ADMIN in a private netns via user namespaces (`unshare -Urn`, enabled by default on Debian/Ubuntu/Fedora and inherent to container runtimes), which is sufficient to create the IPv6 dsts and destroy the namespace; no real root is needed.\nUI:N - The attacker performs every step itself \u2014 namespace creation, IPv6 traffic/exception-route generation, and namespace teardown \u2014 with no victim action required.\nS:U - The freed per-cpu memory and the resulting corruption are kernel objects within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free: `percpu_counter_add_batch()` reads `this_cpu_read(*fbc-\u003ecounters)` from `free_percpu()`\u0027d memory that another subsystem has since reallocated, and the slow path folds that stolen value into `fbc-\u003ecount`, which is observable via `dst_entries_get_slow()`; escalating the per-cpu `percpu_ref` decrement to a real object UAF yields arbitrary kernel read.\nI:H - The same code path performs a `this_cpu_try_cmpxchg` **write** into the freed/reallocated per-cpu slot \u2014 a groomable, repeatable decrement primitive on arbitrary per-cpu state \u2014 and once `fbc-\u003ecounters` is NULLed it writes at per-cpu offset 0, corrupting `pcpu_hot.current_task` on x86_64, which is directly leveragable for control-flow hijack and privilege escalation.\nA:H - The reported failure is a KASAN use-after-free splat during netns dismantle, and corrupting freed per-cpu memory or the `current_task` pointer reliably produces an oops/panic; the teardown loop can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:09.713Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d"
        }
      ],
      "title": "net: do not delay dst_entries_add() in dst_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50036",
    "datePublished": "2024-10-21T19:39:37.135Z",
    "dateReserved": "2024-10-21T12:17:06.070Z",
    "dateUpdated": "2026-08-05T11:41:09.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50036",
      "date": "2026-09-16",
      "epss": "0.00247",
      "percentile": "0.16155"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:56:50.000Z",
      "cve": "CVE-2024-50036",
      "id": "msrc_CVE-2024-50036",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: do not delay dst_entries_add() in dst_release()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50036.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50036\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:16.717\",\"lastModified\":\"2026-08-04T11:21:10.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not delay dst_entries_add() in dst_release()\\n\\ndst_entries_add() uses per-cpu data that might be freed at netns\\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\\n\\nBefore ip6_route_net_exit() can be called, we release all\\nthe dsts associated with this netns, via calls to dst_release(),\\nwhich waits an rcu grace period before calling dst_destroy()\\n\\ndst_entries_add() use in dst_destroy() is racy, because\\ndst_entries_destroy() could have been called already.\\n\\nDecrementing the number of dsts must happen sooner.\\n\\nNotes:\\n\\n1) in CONFIG_XFRM case, dst_destroy() can call\\n   dst_release_immediate(child), this might also cause UAF\\n   if the child does not have DST_NOCOUNT set.\\n   IPSEC maintainers might take a look and see how to address this.\\n\\n2) There is also discussion about removing this count of dst,\\n   which might happen in future kernels.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no retrasar dst_entries_add() en dst_release() dst_entries_add() usa datos por CPU que podr\u00edan liberarse en el desmantelamiento de netns de ip6_route_net_exit() llamando a dst_entries_destroy() Antes de que se pueda llamar a ip6_route_net_exit(), liberamos todos los dst asociados con este netns, a trav\u00e9s de llamadas a dst_release(), que espera un per\u00edodo de gracia de rcu antes de llamar a dst_destroy() El uso de dst_entries_add() en dst_destroy() es arriesgado, porque dst_entries_destroy() ya podr\u00eda haberse llamado. La disminuci\u00f3n del n\u00famero de dst debe ocurrir antes. Notas: 1) en el caso de CONFIG_XFRM, dst_destroy() puede llamar a dst_release_immediate(child), lo que tambi\u00e9n podr\u00eda causar UAF si el hijo no tiene DST_NOCOUNT configurado. Los encargados del mantenimiento de IPSEC podr\u00edan echar un vistazo y ver c\u00f3mo solucionar esto. 2) Tambi\u00e9n se est\u00e1 discutiendo sobre la eliminaci\u00f3n de este recuento de dst, lo que podr\u00eda suceder en kernels futuros.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/dst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"547087307bc19417b4f2bc85ba9664a3e8db5a6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"e3915f028b1f1c37e87542e5aadd33728c259d96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"a60db84f772fc3a906c6c4072f9207579c41166f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"eae7435b48ffc8e9be0ff9cfeae40af479a609dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f88649721268999bdff09777847080a52004f691\",\"lessThan\":\"ac888d58869bb99753e7652be19a151df9ecb35d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"591b1e1bb40152e22cee757f493046a0ca946bf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"df90819dafcd6b97fc665f63a15752a570e227a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a4fe697023dbe6c25caa1f8b2153af869a29bd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.10.50\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.12.26\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.14.14\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.15.7\",\"lessThan\":\"3.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/dst.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.230\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.172\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.117\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.57\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.4\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:25:25.259782Z\",\"id\":\"CVE-2024-50036\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.50\",\"versionEndExcluding\":\"3.11\",\"matchCriteriaId\":\"EB008871-978A-402A-8407-15291079DC44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.26\",\"versionEndExcluding\":\"3.13\",\"matchCriteriaId\":\"597B9ABF-E2FF-405B-8226-0BD990181032\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14.14\",\"versionEndExcluding\":\"3.15\",\"matchCriteriaId\":\"6241E34F-0DAB-4BE0-AD33-1BEEDA5841C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.15.7\",\"versionEndExcluding\":\"3.16\",\"matchCriteriaId\":\"F88CDBE1-4ECE-4BE4-B2A6-7E814D3EA822\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"6.6.57\",\"matchCriteriaId\":\"8D4764C3-4502-4F9B-8704-85262723C867\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"AA84D336-CE9A-4535-B901-1AD77EC17C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:38:33+00:00",
      "cve": "CVE-2024-50036",
      "id": "CVE-2024-50036",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: do not delay dst_entries_add() in dst_release()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50036.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:42.427Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50036\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:25:25.259782Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:25:28.324Z\"}}], \"cna\": {\"title\": \"net: do not delay dst_entries_add() in dst_release()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"547087307bc19417b4f2bc85ba9664a3e8db5a6a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"e3915f028b1f1c37e87542e5aadd33728c259d96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"a60db84f772fc3a906c6c4072f9207579c41166f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"eae7435b48ffc8e9be0ff9cfeae40af479a609dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f88649721268999bdff09777847080a52004f691\", \"lessThan\": \"ac888d58869bb99753e7652be19a151df9ecb35d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"86e48c03d774e01ccd71ecba4fc4b5c2bc0b5b41\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"591b1e1bb40152e22cee757f493046a0ca946bf8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"df90819dafcd6b97fc665f63a15752a570e227a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a4fe697023dbe6c25caa1f8b2153af869a29bd2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.10.50\", \"lessThan\": \"3.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.12.26\", \"lessThan\": \"3.13\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.14.14\", \"lessThan\": \"3.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.15.7\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/core/dst.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.172\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/dst.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/547087307bc19417b4f2bc85ba9664a3e8db5a6a\"}, {\"url\": \"https://git.kernel.org/stable/c/e3915f028b1f1c37e87542e5aadd33728c259d96\"}, {\"url\": \"https://git.kernel.org/stable/c/a60db84f772fc3a906c6c4072f9207579c41166f\"}, {\"url\": \"https://git.kernel.org/stable/c/eae7435b48ffc8e9be0ff9cfeae40af479a609dd\"}, {\"url\": \"https://git.kernel.org/stable/c/3c7c918ec0aa3555372c5a57f18780b7a96c5cfc\"}, {\"url\": \"https://git.kernel.org/stable/c/ac888d58869bb99753e7652be19a151df9ecb35d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not delay dst_entries_add() in dst_release()\\n\\ndst_entries_add() uses per-cpu data that might be freed at netns\\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\\n\\nBefore ip6_route_net_exit() can be called, we release all\\nthe dsts associated with this netns, via calls to dst_release(),\\nwhich waits an rcu grace period before calling dst_destroy()\\n\\ndst_entries_add() use in dst_destroy() is racy, because\\ndst_entries_destroy() could have been called already.\\n\\nDecrementing the number of dsts must happen sooner.\\n\\nNotes:\\n\\n1) in CONFIG_XFRM case, dst_destroy() can call\\n   dst_release_immediate(child), this might also cause UAF\\n   if the child does not have DST_NOCOUNT set.\\n   IPSEC maintainers might take a look and see how to address this.\\n\\n2) There is also discussion about removing this count of dst,\\n   which might happen in future kernels.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.230\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.172\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.117\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.10.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.12.26\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.14.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.15.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:16.288Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50036\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:16.288Z\", \"dateReserved\": \"2024-10-21T12:17:06.070Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:37.135Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.