CVE-2024-44985

ipv6: prevent possible UAF in ip6_xmit()

State: Published
Severity: 9.8 Critical
Published: Sep 4, 2024
Updated: Aug 5, 2026
Reserved: Aug 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible UAF in ip6_xmit()

If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed.

We must use rcu_read_lock() to prevent a possible UAF.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	81d626b00bdba16504eeae9cc891b18e83a9471a to before b3a3d5333c13a1be57499581eab4a8fc94d57f36Affected ee6b1db17f8287b615448488fc37f42bcfe9ece6 to before c47e022011719fc5727bca661d662303180535baAffected 0c9f227bee11910a49e1d159abe102d06e3745d5 to before 975f764e96f71616b530e300c1bb2ac0ce0c2596Affected 0c9f227bee11910a49e1d159abe102d06e3745d5 to before 38a21c026ed2cc7232414cb166efc1923f34af17Affected 0c9f227bee11910a49e1d159abe102d06e3745d5 to before 124b428fe28064c809e4237b0b38e97200a8a4a8Affected 0c9f227bee11910a49e1d159abe102d06e3745d5 to before fc88d6c1f2895a5775795d82ec581afdff7661d1Affected 0c9f227bee11910a49e1d159abe102d06e3745d5 to before 2d5ff7e339d04622d8282661df36151906d0e1c7Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.166 through 5.15.Not affected 6.1.107 through 6.1.Not affected 6.6.48 through 6.6.Not affected 6.10.7 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

81d626b00bdba16504eeae9cc891b18e83a9471a to before b3a3d5333c13a1be57499581eab4a8fc94d57f36Affected
ee6b1db17f8287b615448488fc37f42bcfe9ece6 to before c47e022011719fc5727bca661d662303180535baAffected
0c9f227bee11910a49e1d159abe102d06e3745d5 to before 975f764e96f71616b530e300c1bb2ac0ce0c2596Affected
0c9f227bee11910a49e1d159abe102d06e3745d5 to before 38a21c026ed2cc7232414cb166efc1923f34af17Affected
0c9f227bee11910a49e1d159abe102d06e3745d5 to before 124b428fe28064c809e4237b0b38e97200a8a4a8Affected
0c9f227bee11910a49e1d159abe102d06e3745d5 to before fc88d6c1f2895a5775795d82ec581afdff7661d1Affected
0c9f227bee11910a49e1d159abe102d06e3745d5 to before 2d5ff7e339d04622d8282661df36151906d0e1c7Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.166 through 5.15.*Not affected
6.1.107 through 6.1.*Not affected
6.6.48 through 6.6.*Not affected
6.10.7 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.