GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-44974 (GCVE-0-2024-44974)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
mptcp: pm: avoid possible UaF when selecting endp
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < ddee5b4b6a1cc03c1e9921cf34382e094c2009f1 (git)
Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < f2c865e9e3ca44fc06b5f73b29a954775e4dbb38 (git)
Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < 2b4f46f9503633dade75cb796dd1949d0e6581a1 (git)
Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < 9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 (git)
Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < 0201d65d9806d287a00e0ba96f0321835631f63f (git)
Affected: 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 , < 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.109 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44974",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:26:21.490934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:14.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:27.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            },
            {
              "lessThan": "f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            },
            {
              "lessThan": "2b4f46f9503633dade75cb796dd1949d0e6581a1",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            },
            {
              "lessThan": "9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            },
            {
              "lessThan": "0201d65d9806d287a00e0ba96f0321835631f63f",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            },
            {
              "lessThan": "48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
              "status": "affected",
              "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: avoid possible UaF when selecting endp\n\nselect_local_address() and select_signal_address() both select an\nendpoint entry from the list inside an RCU protected section, but return\na reference to it, to be read later on. If the entry is dereferenced\nafter the RCU unlock, reading info could cause a Use-after-Free.\n\nA simple solution is to copy the required info while inside the RCU\nprotected section to avoid any risk of UaF later. The address ID might\nneed to be modified later to handle the ID0 case later, so a copy seems\nOK to deal with."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The freeing half of the race requires issuing MPTCP path-manager generic-netlink commands (MPTCP_PM_CMD_DEL_ADDR / FLUSH_ADDRS), which is a local operation; although the reading half is driven by remote MPTCP handshake events, exploitation requires local netlink access.\nAC:L - The attacker controls both sides of the race and the window is very wide \u2014 the stale pointer is used after msk-\u003epm.lock is dropped and across sleeping kernel_bind()/kernel_connect() and socket allocation in mptcp worker context \u2014 so the RCU grace period reliably elapses before the dereference.\nPR:L - The MPTCP PM netlink ops are GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in a user-namespace-owned netns obtained via `unshare -Urn` suffices; MPTCP is enabled by default per-netns and creating IPPROTO_MPTCP sockets needs no privilege.\nUI:N - The attacker triggers connection establishment and endpoint deletion entirely on their own; no victim action is needed.\nS:U - The use-after-free is confined to kernel heap objects within the same security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Freed heap contents are read as a mptcp_addr_info and both copied into the ADD_ADDR option transmitted to the remote peer and used as the bind address of a new subflow, leaking freed kernel memory repeatably; a reclaimed object additionally gives a general UAF read primitive.\nI:H - This is a use-after-free \u2014 the freed slab object can be reclaimed with attacker-sprayed data that then drives socket family selection, bind/connect addressing, and id_avail_bitmap clearing, giving heap-manipulation leverage toward control-flow hijacking.\nA:H - Dereferencing the freed mptcp_pm_addr_entry causes use-after-free oopses/panics (KASAN-reported), and the race can be re-triggered at will to crash the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:24.489Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f"
        },
        {
          "url": "https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d"
        }
      ],
      "title": "mptcp: pm: avoid possible UaF when selecting endp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44974",
    "datePublished": "2024-09-04T19:54:26.917Z",
    "dateReserved": "2024-08-21T05:34:56.669Z",
    "dateUpdated": "2026-08-05T11:37:24.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44974",
      "date": "2026-09-20",
      "epss": "0.00272",
      "percentile": "0.1978"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3C120709-9CC8-4B99-81CC-CA805D1EABD5",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D2AFDFD1-D95A-4EB7-843B-5E7659518B67",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: avoid possible UaF when selecting endp\n\nselect_local_address() and select_signal_address() both select an\nendpoint entry from the list inside an RCU protected section, but return\na reference to it, to be read later on. If the entry is dereferenced\nafter the RCU unlock, reading info could cause a Use-after-Free.\n\nA simple solution is to copy the required info while inside the RCU\nprotected section to avoid any risk of UaF later. The address ID might\nneed to be modified later to handle the ID0 case later, so a copy seems\nOK to deal with."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: pm: evitar posible UaF al seleccionar endp select_local_address() y select_signal_address() seleccionan una entrada de endpoint de la lista dentro de una secci\u00f3n protegida de RCU, pero devuelven una referencia a ella, para leerla m\u00e1s tarde. Si se desreferencia la entrada despu\u00e9s del desbloqueo de RCU, leer informaci\u00f3n podr\u00eda causar un Use-after-Free. Una soluci\u00f3n simple es copiar la informaci\u00f3n requerida mientras se est\u00e1 dentro de la secci\u00f3n protegida de RCU para evitar cualquier riesgo de UaF m\u00e1s adelante. Es posible que el ID de la direcci\u00f3n deba modificarse m\u00e1s tarde para manejar el caso ID0 m\u00e1s tarde, por lo que una copia parece ser una buena opci\u00f3n."
        }
      ],
      "id": "CVE-2024-44974",
      "lastModified": "2024-09-12T12:15:51.397",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-09-04T20:15:07.100",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:24:44.000Z",
      "cve": "CVE-2024-44974",
      "id": "msrc_CVE-2024-44974",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: pm: avoid possible UaF when selecting endp",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-44974.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/pm_netlink.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b4f46f9503633dade75cb796dd1949d0e6581a1",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0201d65d9806d287a00e0ba96f0321835631f63f",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
                    "status": "affected",
                    "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/pm_netlink.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.226",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.167",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.48",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38ED0DCC-BFFE-4561-A649-90A221FACA09",
                    "versionEndExcluding": "5.10.226",
                    "versionStartIncluding": "5.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "043405A4-25FE-45D4-A7BB-2A0C3B7D17C1",
                    "versionEndExcluding": "5.15.167",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "790F505A-7933-48F1-B038-380A8BC5C153",
                    "versionEndExcluding": "6.1.109",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9DE9201A-CE6B-4726-BABB-8265EA0F8AE4",
                    "versionEndExcluding": "6.6.48",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2AFDFD1-D95A-4EB7-843B-5E7659518B67",
                    "versionEndExcluding": "6.10.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: avoid possible UaF when selecting endp\n\nselect_local_address() and select_signal_address() both select an\nendpoint entry from the list inside an RCU protected section, but return\na reference to it, to be read later on. If the entry is dereferenced\nafter the RCU unlock, reading info could cause a Use-after-Free.\n\nA simple solution is to copy the required info while inside the RCU\nprotected section to avoid any risk of UaF later. The address ID might\nneed to be modified later to handle the ID0 case later, so a copy seems\nOK to deal with."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: pm: evitar posible UaF al seleccionar endp select_local_address() y select_signal_address() seleccionan una entrada de endpoint de la lista dentro de una secci\u00f3n protegida de RCU, pero devuelven una referencia a ella, para leerla m\u00e1s tarde. Si se desreferencia la entrada despu\u00e9s del desbloqueo de RCU, leer informaci\u00f3n podr\u00eda causar un Use-after-Free. Una soluci\u00f3n simple es copiar la informaci\u00f3n requerida mientras se est\u00e1 dentro de la secci\u00f3n protegida de RCU para evitar cualquier riesgo de UaF m\u00e1s adelante. Es posible que el ID de la direcci\u00f3n deba modificarse m\u00e1s tarde para manejar el caso ID0 m\u00e1s tarde, por lo que una copia parece ser una buena opci\u00f3n."
          }
        ],
        "id": "CVE-2024-44974",
        "lastModified": "2026-08-04T11:20:05.717",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-44974",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:26:21.490934Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-04T20:15:07.100",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:17:54+00:00",
      "cve": "CVE-2024-44974",
      "id": "CVE-2024-44974",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: pm: avoid possible UaF when selecting endp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44974.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:14:05Z",
      "cve": "CVE-2024-44974",
      "id": "CVE-2024-44974",
      "initial_release_date": "2024-09-05T02:46:54Z",
      "product_status:known_affected": "597",
      "product_status:known_not_affected": "293",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44974",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44974.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:14:27.070Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-44974",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:26:21.490934Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:18.933Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/mptcp/pm_netlink.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                },
                {
                  "lessThan": "f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                },
                {
                  "lessThan": "2b4f46f9503633dade75cb796dd1949d0e6581a1",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                },
                {
                  "lessThan": "9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                },
                {
                  "lessThan": "0201d65d9806d287a00e0ba96f0321835631f63f",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                },
                {
                  "lessThan": "48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
                  "status": "affected",
                  "version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/mptcp/pm_netlink.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.7"
                },
                {
                  "lessThan": "5.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.226",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.167",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.48",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.226",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.167",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.109",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.48",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.7",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "5.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: avoid possible UaF when selecting endp\n\nselect_local_address() and select_signal_address() both select an\nendpoint entry from the list inside an RCU protected section, but return\na reference to it, to be read later on. If the entry is dereferenced\nafter the RCU unlock, reading info could cause a Use-after-Free.\n\nA simple solution is to copy the required info while inside the RCU\nprotected section to avoid any risk of UaF later. The address ID might\nneed to be modified later to handle the ID0 case later, so a copy seems\nOK to deal with."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The freeing half of the race requires issuing MPTCP path-manager generic-netlink commands (MPTCP_PM_CMD_DEL_ADDR / FLUSH_ADDRS), which is a local operation; although the reading half is driven by remote MPTCP handshake events, exploitation requires local netlink access.\nAC:L - The attacker controls both sides of the race and the window is very wide \u2014 the stale pointer is used after msk-\u003epm.lock is dropped and across sleeping kernel_bind()/kernel_connect() and socket allocation in mptcp worker context \u2014 so the RCU grace period reliably elapses before the dereference.\nPR:L - The MPTCP PM netlink ops are GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in a user-namespace-owned netns obtained via `unshare -Urn` suffices; MPTCP is enabled by default per-netns and creating IPPROTO_MPTCP sockets needs no privilege.\nUI:N - The attacker triggers connection establishment and endpoint deletion entirely on their own; no victim action is needed.\nS:U - The use-after-free is confined to kernel heap objects within the same security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Freed heap contents are read as a mptcp_addr_info and both copied into the ADD_ADDR option transmitted to the remote peer and used as the bind address of a new subflow, leaking freed kernel memory repeatably; a reclaimed object additionally gives a general UAF read primitive.\nI:H - This is a use-after-free \u2014 the freed slab object can be reclaimed with attacker-sprayed data that then drives socket family selection, bind/connect addressing, and id_avail_bitmap clearing, giving heap-manipulation leverage toward control-flow hijacking.\nA:H - Dereferencing the freed mptcp_pm_addr_entry causes use-after-free oopses/panics (KASAN-reported), and the race can be re-triggered at will to crash the machine."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:37:24.489Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1"
            },
            {
              "url": "https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38"
            },
            {
              "url": "https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1"
            },
            {
              "url": "https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8"
            },
            {
              "url": "https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f"
            },
            {
              "url": "https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d"
            }
          ],
          "title": "mptcp: pm: avoid possible UaF when selecting endp",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-44974",
        "datePublished": "2024-09-04T19:54:26.917Z",
        "dateReserved": "2024-08-21T05:34:56.669Z",
        "dateUpdated": "2026-08-05T11:37:24.489Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.