CVE-2024-36903

ipv6: Fix potential uninit-value access in __ip6_make_skb()

State: Published
Severity: Not scored
Published: May 30, 2024
Updated: Oct 15, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix potential uninit-value access in __ip6_make_skb()

As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	605b056d63302ae84eb136e88d4df49124bd5e0d to before 59d74c843ebf46264c7903726cf6f2673a93b07aAffected d65ff2fe877c471aa6e79efa7bd8ff66e147c317 to before 40e5444a3ac315b60e94d82226b73cd82145d09eAffected 2c9cefc142c1dc2759e19a92d3b2b3715e985beb to before a05c1ede50e9656f0752e523c7b54f3a3489e9a8Affected ea30388baebcce37fd594d425a65037ca35e59e8 to before 68c8ba16ab712eb709c6bab80ff151079d11d97aAffected ea30388baebcce37fd594d425a65037ca35e59e8 to before 2367bf254f3a27ecc6e229afd7a8b0a1395f7be3Affected ea30388baebcce37fd594d425a65037ca35e59e8 to before 4e13d3a9c25b7080f8a619f961e943fe08c2672cAffected 165370522cc48127da564a08584a7391e6341908Affected f394f690a30a5ec0413c62777a058eaf3d6e10d5Affected 0cf600ca1bdf1d52df977516ee6cee0cadb1f6b1Affected 02ed5700f40445af02d1c97db25ffc2d04971d9fAffected 5.10.178 to before 5.10.248Affected 5.15.107 to before 5.15.198Affected 6.1.24 to before 6.1.140Affected 4.14.313 to before 4.15Affected 4.19.281 to before 4.20Affected 5.4.241 to before 5.5Affected 6.2.11 to before 6.3Affected
LinuxLinux	6.3Affected before 6.3Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.140 through 6.1.Not affected 6.6.31 through 6.6.Not affected 6.8.10 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

605b056d63302ae84eb136e88d4df49124bd5e0d to before 59d74c843ebf46264c7903726cf6f2673a93b07aAffected
d65ff2fe877c471aa6e79efa7bd8ff66e147c317 to before 40e5444a3ac315b60e94d82226b73cd82145d09eAffected
2c9cefc142c1dc2759e19a92d3b2b3715e985beb to before a05c1ede50e9656f0752e523c7b54f3a3489e9a8Affected
ea30388baebcce37fd594d425a65037ca35e59e8 to before 68c8ba16ab712eb709c6bab80ff151079d11d97aAffected
ea30388baebcce37fd594d425a65037ca35e59e8 to before 2367bf254f3a27ecc6e229afd7a8b0a1395f7be3Affected
ea30388baebcce37fd594d425a65037ca35e59e8 to before 4e13d3a9c25b7080f8a619f961e943fe08c2672cAffected
165370522cc48127da564a08584a7391e6341908Affected
f394f690a30a5ec0413c62777a058eaf3d6e10d5Affected
0cf600ca1bdf1d52df977516ee6cee0cadb1f6b1Affected
02ed5700f40445af02d1c97db25ffc2d04971d9fAffected
5.10.178 to before 5.10.248Affected
5.15.107 to before 5.15.198Affected
6.1.24 to before 6.1.140Affected
4.14.313 to before 4.15Affected
4.19.281 to before 4.20Affected
5.4.241 to before 5.5Affected
6.2.11 to before 6.3Affected

LinuxLinux

6.3Affected
before 6.3Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.140 through 6.1.*Not affected
6.6.31 through 6.6.*Not affected
6.8.10 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.