GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-42109 (GCVE-0-2024-42109)

Vulnerability from cvelistv5 – Published: 2024-07-30 07:46 – Updated: 2026-08-05 11:35
VLAI
Title
netfilter: nf_tables: unconditionally flush pending work before notifier
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally. We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases. AFAICS this problem is only exposed in nf-next, with commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), with this commit applied there is an unconditional fetch of table->family which is whats triggering the above splat.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:17 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f22954f8c58fd5f5489f5980796914e306757e77 , < 3325628cb36b7f216c5716e7b5124d9dc81199e4 (git)
Affected: 41841b585e53babdfb0fa6fdfa54f6d7c28c1206 , < 4c06c13317b9a08decedcd7aaf706691e336277c (git)
Affected: 2c9f0293280e258606e54ed2b96fa71498432eae , < 55a40406aac555defe9bdd0adec9508116ce7cb1 (git)
Affected: 2c9f0293280e258606e54ed2b96fa71498432eae , < 09e650c3a3a7d804430260510534ccbf71c75b2e (git)
Affected: 2c9f0293280e258606e54ed2b96fa71498432eae , < 9f6958ba2e902f9820c594869bd710ba74b7c4c0 (git)
Affected: 4167aa477abcf62b0dfda51f3513280fa73cd588 (git)
Affected: 5.15.129 , < 5.15.163 (semver)
Affected: 6.1.50 , < 6.1.98 (semver)
Affected: 6.4.13 , < 6.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 5.15.163 , ≤ 5.15.* (semver)
Unaffected: 6.1.98 , ≤ 6.1.* (semver)
Unaffected: 6.6.39 , ≤ 6.6.* (semver)
Unaffected: 6.9.9 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:01:44.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:17:36.218121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:06.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3325628cb36b7f216c5716e7b5124d9dc81199e4",
              "status": "affected",
              "version": "f22954f8c58fd5f5489f5980796914e306757e77",
              "versionType": "git"
            },
            {
              "lessThan": "4c06c13317b9a08decedcd7aaf706691e336277c",
              "status": "affected",
              "version": "41841b585e53babdfb0fa6fdfa54f6d7c28c1206",
              "versionType": "git"
            },
            {
              "lessThan": "55a40406aac555defe9bdd0adec9508116ce7cb1",
              "status": "affected",
              "version": "2c9f0293280e258606e54ed2b96fa71498432eae",
              "versionType": "git"
            },
            {
              "lessThan": "09e650c3a3a7d804430260510534ccbf71c75b2e",
              "status": "affected",
              "version": "2c9f0293280e258606e54ed2b96fa71498432eae",
              "versionType": "git"
            },
            {
              "lessThan": "9f6958ba2e902f9820c594869bd710ba74b7c4c0",
              "status": "affected",
              "version": "2c9f0293280e258606e54ed2b96fa71498432eae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4167aa477abcf62b0dfda51f3513280fa73cd588",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.163",
              "status": "affected",
              "version": "5.15.129",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.98",
              "status": "affected",
              "version": "6.1.50",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.98",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.163",
                  "versionStartIncluding": "5.15.129",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.98",
                  "versionStartIncluding": "6.1.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.39",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally flush pending work before notifier\n\nsyzbot reports:\n\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\n\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\n\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\n\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable-\u003efamily which is whats triggering the above splat."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only through `sendmsg()`/`close()` on a local `AF_NETLINK`/`NETLINK_NETFILTER` socket handled by `nfnetlink_rcv_msg()`; the notifier `nft_rcv_nl_event()` fires on local socket release. There is no remote or adjacent-network route into nf_tables transaction teardown.\nAC:L - The attacker drives both halves of the race \u2014 issuing the nftables commit that queues transactions to `nf_tables_destroy_list` and schedule `trans_destroy_work`, then closing the owning netlink socket \u2014 and the worker\u0027s `list_splice_init()` plus `synchronize_rcu()` leaves a millisecond-wide window in which `list_empty()` is falsely true. The sequence is deterministic to set up and infinitely retryable, and syzbot produced a working reproducer.\nPR:L - The only check is `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is `ns_capable(sock_net(sk)-\u003euser_ns, CAP_NET_ADMIN)` \u2014 satisfied by any unprivileged user via `unshare -Urn` on distros with unprivileged user namespaces enabled. No real root in the init namespace is required.\nUI:N - The attacker performs the entire sequence \u2014 table creation with `NFT_TABLE_F_OWNER`, the delete commit, and the socket close \u2014 from its own process with no victim involvement.\nS:U - The freed object and all its dereferences live in kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a confirmed slab use-after-free read of the `nft_table` object (`kmalloc-cg-*`, syzbot: \"Read of size 2\"); an attacker can reoccupy the freed slot by heap spraying and have the worker read attacker-chosen data, including the `ctx-\u003etable-\u003ename` pointer consumed by `nft_compat`, yielding an information-disclosure primitive.\nI:H - The dangling `trans-\u003ectx.table` is fed to `nft_set_destroy()`, `nf_tables_chain_destroy()`, `nft_obj_destroy()` and every expression `-\u003edestroy()` callback, so a reclaimed slot lets the attacker steer subsequent frees, refcount decrements, and function-pointer-driven teardown \u2014 a classic UAF path to controlled writes and control-flow hijack.\nA:H - Even unexploited, the use-after-free corrupts kernel state inside a workqueue context and reliably produces an oops/panic, as demonstrated by the syzbot KASAN splat in `nf_tables_trans_destroy_work`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:41.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c"
        },
        {
          "url": "https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0"
        }
      ],
      "title": "netfilter: nf_tables: unconditionally flush pending work before notifier",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42109",
    "datePublished": "2024-07-30T07:46:04.194Z",
    "dateReserved": "2024-07-29T15:50:41.176Z",
    "dateUpdated": "2026-08-05T11:35:41.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42109",
      "date": "2026-09-15",
      "epss": "0.00249",
      "percentile": "0.164"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.129\", \"versionEndExcluding\": \"5.15.163\", \"matchCriteriaId\": \"5FD25434-47C3-45B8-B46A-6352379CD2F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.50\", \"versionEndExcluding\": \"6.1.98\", \"matchCriteriaId\": \"24E84470-CB41-4B10-ACC2-6579459F3A48\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5\", \"versionEndExcluding\": \"6.6.39\", \"matchCriteriaId\": \"E079242F-1B25-40DA-BCE2-2A7965C9168E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.9\", \"matchCriteriaId\": \"ADCC1407-0CB3-4C8F-B4C5-07F682CD7085\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: unconditionally flush pending work before notifier\\n\\nsyzbot reports:\\n\\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\\n[..]\\nWorkqueue: events nf_tables_trans_destroy_work\\nCall Trace:\\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\n\\nProblem is that the notifier does a conditional flush, but its possible\\nthat the table-to-be-removed is still referenced by transactions being\\nprocessed by the worker, so we need to flush unconditionally.\\n\\nWe could make the flush_work depend on whether we found a table to delete\\nin nf-next to avoid the flush for most cases.\\n\\nAFAICS this problem is only exposed in nf-next, with\\ncommit e169285f8c56 (\\\"netfilter: nf_tables: do not store nft_ctx in transaction objects\\\"),\\nwith this commit applied there is an unconditional fetch of\\ntable-\u003efamily which is whats triggering the above splat.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: vaciar incondicionalmente el trabajo pendiente antes de que el notificador syzbot informe: KASAN: slab-uaf en nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf en nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Lectura de tama\\u00f1o 2 en la direcci\\u00f3n ffff88802b0051c4 por tarea kworker/1:1/45 [..] ue : eventos nf_tables_trans_destroy_work Seguimiento de llamadas: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [en l\\u00ednea] nft_commit_release net/netfilter/nf_tables_api.c:9530 [en l\\u00ednea] nf_tables_trans_destroy_work+0x152b/0x1750 s_api.c:9597 El problema es que el notificador realiza un vaciado condicional, pero es posible que las transacciones que procesa el trabajador a\\u00fan hagan referencia a la tabla que se va a eliminar, por lo que debemos realizar un vaciado incondicional. Podr\\u00edamos hacer que flux_work dependa de si encontramos una tabla para eliminar en nf-next para evitar el vaciado en la mayor\\u00eda de los casos. AFAICS, este problema solo se expone en nf-next, con la confirmaci\\u00f3n e169285f8c56 (\\\"netfilter: nf_tables: no almacenar nft_ctx en objetos de transacci\\u00f3n\\\"), con esta confirmaci\\u00f3n aplicada hay una b\\u00fasqueda incondicional de tabla-\u0026gt;familia que es lo que desencadena lo anterior salpicar.\"}]",
      "id": "CVE-2024-42109",
      "lastModified": "2024-11-21T09:33:37.223",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-30T08:15:03.407",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42109\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-30T08:15:03.407\",\"lastModified\":\"2026-08-04T11:19:34.947\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: unconditionally flush pending work before notifier\\n\\nsyzbot reports:\\n\\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\\n[..]\\nWorkqueue: events nf_tables_trans_destroy_work\\nCall Trace:\\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\n\\nProblem is that the notifier does a conditional flush, but its possible\\nthat the table-to-be-removed is still referenced by transactions being\\nprocessed by the worker, so we need to flush unconditionally.\\n\\nWe could make the flush_work depend on whether we found a table to delete\\nin nf-next to avoid the flush for most cases.\\n\\nAFAICS this problem is only exposed in nf-next, with\\ncommit e169285f8c56 (\\\"netfilter: nf_tables: do not store nft_ctx in transaction objects\\\"),\\nwith this commit applied there is an unconditional fetch of\\ntable-\u003efamily which is whats triggering the above splat.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: vaciar incondicionalmente el trabajo pendiente antes de que el notificador syzbot informe: KASAN: slab-uaf en nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf en nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Lectura de tama\u00f1o 2 en la direcci\u00f3n ffff88802b0051c4 por tarea kworker/1:1/45 [..] ue : eventos nf_tables_trans_destroy_work Seguimiento de llamadas: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [en l\u00ednea] nft_commit_release net/netfilter/nf_tables_api.c:9530 [en l\u00ednea] nf_tables_trans_destroy_work+0x152b/0x1750 s_api.c:9597 El problema es que el notificador realiza un vaciado condicional, pero es posible que las transacciones que procesa el trabajador a\u00fan hagan referencia a la tabla que se va a eliminar, por lo que debemos realizar un vaciado incondicional. Podr\u00edamos hacer que flux_work dependa de si encontramos una tabla para eliminar en nf-next para evitar el vaciado en la mayor\u00eda de los casos. AFAICS, este problema solo se expone en nf-next, con la confirmaci\u00f3n e169285f8c56 (\\\"netfilter: nf_tables: no almacenar nft_ctx en objetos de transacci\u00f3n\\\"), con esta confirmaci\u00f3n aplicada hay una b\u00fasqueda incondicional de tabla-\u0026gt;familia que es lo que desencadena lo anterior salpicar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_tables_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f22954f8c58fd5f5489f5980796914e306757e77\",\"lessThan\":\"3325628cb36b7f216c5716e7b5124d9dc81199e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41841b585e53babdfb0fa6fdfa54f6d7c28c1206\",\"lessThan\":\"4c06c13317b9a08decedcd7aaf706691e336277c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c9f0293280e258606e54ed2b96fa71498432eae\",\"lessThan\":\"55a40406aac555defe9bdd0adec9508116ce7cb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c9f0293280e258606e54ed2b96fa71498432eae\",\"lessThan\":\"09e650c3a3a7d804430260510534ccbf71c75b2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c9f0293280e258606e54ed2b96fa71498432eae\",\"lessThan\":\"9f6958ba2e902f9820c594869bd710ba74b7c4c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4167aa477abcf62b0dfda51f3513280fa73cd588\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.129\",\"lessThan\":\"5.15.163\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.50\",\"lessThan\":\"6.1.98\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.4.13\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_tables_api.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.163\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.98\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.39\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.9\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:17:36.218121Z\",\"id\":\"CVE-2024-42109\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.129\",\"versionEndExcluding\":\"5.15.163\",\"matchCriteriaId\":\"5FD25434-47C3-45B8-B46A-6352379CD2F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.50\",\"versionEndExcluding\":\"6.1.98\",\"matchCriteriaId\":\"24E84470-CB41-4B10-ACC2-6579459F3A48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.39\",\"matchCriteriaId\":\"E079242F-1B25-40DA-BCE2-2A7965C9168E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.9\",\"matchCriteriaId\":\"ADCC1407-0CB3-4C8F-B4C5-07F682CD7085\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:42:33+00:00",
      "cve": "CVE-2024-42109",
      "id": "CVE-2024-42109",
      "initial_release_date": "2024-07-30T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: unconditionally flush pending work before notifier",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42109.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:29:18Z",
      "cve": "CVE-2024-42109",
      "id": "CVE-2024-42109",
      "initial_release_date": "2024-08-06T01:59:54Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "355",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42109",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42109.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:01:44.106Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42109\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:17:36.218121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.593Z\"}}], \"cna\": {\"title\": \"netfilter: nf_tables: unconditionally flush pending work before notifier\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f22954f8c58fd5f5489f5980796914e306757e77\", \"lessThan\": \"3325628cb36b7f216c5716e7b5124d9dc81199e4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"41841b585e53babdfb0fa6fdfa54f6d7c28c1206\", \"lessThan\": \"4c06c13317b9a08decedcd7aaf706691e336277c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c9f0293280e258606e54ed2b96fa71498432eae\", \"lessThan\": \"55a40406aac555defe9bdd0adec9508116ce7cb1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c9f0293280e258606e54ed2b96fa71498432eae\", \"lessThan\": \"09e650c3a3a7d804430260510534ccbf71c75b2e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c9f0293280e258606e54ed2b96fa71498432eae\", \"lessThan\": \"9f6958ba2e902f9820c594869bd710ba74b7c4c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4167aa477abcf62b0dfda51f3513280fa73cd588\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.129\", \"lessThan\": \"5.15.163\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.50\", \"lessThan\": \"6.1.98\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.4.13\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/netfilter/nf_tables_api.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.98\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.39\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_tables_api.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4\"}, {\"url\": \"https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c\"}, {\"url\": \"https://git.kernel.org/stable/c/55a40406aac555defe9bdd0adec9508116ce7cb1\"}, {\"url\": \"https://git.kernel.org/stable/c/09e650c3a3a7d804430260510534ccbf71c75b2e\"}, {\"url\": \"https://git.kernel.org/stable/c/9f6958ba2e902f9820c594869bd710ba74b7c4c0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: unconditionally flush pending work before notifier\\n\\nsyzbot reports:\\n\\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\\n[..]\\nWorkqueue: events nf_tables_trans_destroy_work\\nCall Trace:\\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\\n\\nProblem is that the notifier does a conditional flush, but its possible\\nthat the table-to-be-removed is still referenced by transactions being\\nprocessed by the worker, so we need to flush unconditionally.\\n\\nWe could make the flush_work depend on whether we found a table to delete\\nin nf-next to avoid the flush for most cases.\\n\\nAFAICS this problem is only exposed in nf-next, with\\ncommit e169285f8c56 (\\\"netfilter: nf_tables: do not store nft_ctx in transaction objects\\\"),\\nwith this commit applied there is an unconditional fetch of\\ntable-\u003efamily which is whats triggering the above splat.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.163\", \"versionStartIncluding\": \"5.15.129\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.98\", \"versionStartIncluding\": \"6.1.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.39\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.9\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:52:06.989Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42109\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:52:06.989Z\", \"dateReserved\": \"2024-07-29T15:50:41.176Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-30T07:46:04.194Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.