GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-44985 (GCVE-0-2024-44985)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
ipv6: prevent possible UAF in ip6_xmit()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 01:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 81d626b00bdba16504eeae9cc891b18e83a9471a , < b3a3d5333c13a1be57499581eab4a8fc94d57f36 (git)
Affected: ee6b1db17f8287b615448488fc37f42bcfe9ece6 , < c47e022011719fc5727bca661d662303180535ba (git)
Affected: 0c9f227bee11910a49e1d159abe102d06e3745d5 , < 975f764e96f71616b530e300c1bb2ac0ce0c2596 (git)
Affected: 0c9f227bee11910a49e1d159abe102d06e3745d5 , < 38a21c026ed2cc7232414cb166efc1923f34af17 (git)
Affected: 0c9f227bee11910a49e1d159abe102d06e3745d5 , < 124b428fe28064c809e4237b0b38e97200a8a4a8 (git)
Affected: 0c9f227bee11910a49e1d159abe102d06e3745d5 , < fc88d6c1f2895a5775795d82ec581afdff7661d1 (git)
Affected: 0c9f227bee11910a49e1d159abe102d06e3745d5 , < 2d5ff7e339d04622d8282661df36151906d0e1c7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.166 , ≤ 5.15.* (semver)
Unaffected: 6.1.107 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44985",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T01:05:42.699758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T01:07:00.575Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:33.082Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3a3d5333c13a1be57499581eab4a8fc94d57f36",
              "status": "affected",
              "version": "81d626b00bdba16504eeae9cc891b18e83a9471a",
              "versionType": "git"
            },
            {
              "lessThan": "c47e022011719fc5727bca661d662303180535ba",
              "status": "affected",
              "version": "ee6b1db17f8287b615448488fc37f42bcfe9ece6",
              "versionType": "git"
            },
            {
              "lessThan": "975f764e96f71616b530e300c1bb2ac0ce0c2596",
              "status": "affected",
              "version": "0c9f227bee11910a49e1d159abe102d06e3745d5",
              "versionType": "git"
            },
            {
              "lessThan": "38a21c026ed2cc7232414cb166efc1923f34af17",
              "status": "affected",
              "version": "0c9f227bee11910a49e1d159abe102d06e3745d5",
              "versionType": "git"
            },
            {
              "lessThan": "124b428fe28064c809e4237b0b38e97200a8a4a8",
              "status": "affected",
              "version": "0c9f227bee11910a49e1d159abe102d06e3745d5",
              "versionType": "git"
            },
            {
              "lessThan": "fc88d6c1f2895a5775795d82ec581afdff7661d1",
              "status": "affected",
              "version": "0c9f227bee11910a49e1d159abe102d06e3745d5",
              "versionType": "git"
            },
            {
              "lessThan": "2d5ff7e339d04622d8282661df36151906d0e1c7",
              "status": "affected",
              "version": "0c9f227bee11910a49e1d159abe102d06e3745d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UAF in ip6_xmit()\n\nIf skb_expand_head() returns NULL, skb has been freed\nand the associated dst/idev could also have been freed.\n\nWe must use rcu_read_lock() to prevent a possible UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The only ip6_xmit() caller lacking a surrounding rcu_read_lock() while holding a refcounted skb dst is tcp_v6_send_response(), driven purely by inbound TCP/IPv6 packets (RST to closed ports via tcp_v6_rcv()\u0027s no_tcp_socket path, TIME_WAIT ACKs, request-sock ACKs). A remote attacker on the internet reaches it with unsolicited TCP segments.\nAC:L - The attacker drives the vulnerable path at unbounded rate with a packet flood, and that same flood produces the GFP_ATOMIC memory pressure that makes skb_expand_head() fail, plus the CPU/scheduling pressure that widens the preemption window in the preemptible backlog-drain context; none of the required conditions lie outside attacker influence.\nPR:N - Generating a TCP RST/ACK reply to a closed or TIME_WAIT IPv6 port requires no credentials, no session, and no prior handshake \u2014 the code path is entirely pre-authentication.\nUI:N - The kernel emits the reply automatically on packet receipt; no local user or administrator action is involved.\nS:U - The freed struct inet6_dev and the resulting corruption are entirely within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The stale idev deref reads a __percpu pointer out of a freed slab object; controlling that object via heap reclaim converts the subsequent per-CPU MIB access into an attacker-directed kernel read, exposing arbitrary kernel memory.\nI:H - SNMP_INC_STATS64 performs a read-modify-write (u64_stats seqcount update plus counter add) at an address derived from the freed object\u0027s contents, yielding a controlled-address kernel write suitable for control-flow hijack once the inet6_dev allocation is groomed.\nA:H - Even unweaponized, dereferencing and incrementing through a freed inet6_dev\u0027s percpu pointer corrupts kernel memory and reliably produces an oops or panic, and the path can be re-triggered remotely at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:27.693Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36"
        },
        {
          "url": "https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a21c026ed2cc7232414cb166efc1923f34af17"
        },
        {
          "url": "https://git.kernel.org/stable/c/124b428fe28064c809e4237b0b38e97200a8a4a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d5ff7e339d04622d8282661df36151906d0e1c7"
        }
      ],
      "title": "ipv6: prevent possible UAF in ip6_xmit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44985",
    "datePublished": "2024-09-04T19:54:34.188Z",
    "dateReserved": "2024-08-21T05:34:56.670Z",
    "dateUpdated": "2026-08-05T11:37:27.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44985",
      "date": "2026-09-16",
      "epss": "0.00876",
      "percentile": "0.57206"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15\", \"versionEndExcluding\": \"5.15.166\", \"matchCriteriaId\": \"1E86C365-0589-4961-B85C-B76395A12CC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.107\", \"matchCriteriaId\": \"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: prevent possible UAF in ip6_xmit()\\n\\nIf skb_expand_head() returns NULL, skb has been freed\\nand the associated dst/idev could also have been freed.\\n\\nWe must use rcu_read_lock() to prevent a possible UAF.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: ipv6: evitar posible UAF en ip6_xmit() Si skb_expand_head() devuelve NULL, skb se ha liberado y el dst/idev asociado tambi\\u00e9n podr\\u00eda haberse liberado. Debemos utilizar rcu_read_lock() para evitar un posible UAF.\"}]",
      "id": "CVE-2024-44985",
      "lastModified": "2025-01-09T16:15:38.177",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-09-04T20:15:07.777",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/124b428fe28064c809e4237b0b38e97200a8a4a8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2d5ff7e339d04622d8282661df36151906d0e1c7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/38a21c026ed2cc7232414cb166efc1923f34af17\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:21:21.000Z",
      "cve": "CVE-2024-44985",
      "id": "msrc_CVE-2024-44985",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipv6: prevent possible UAF in ip6_xmit()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-44985.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44985\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:07.777\",\"lastModified\":\"2026-08-04T11:20:06.457\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: prevent possible UAF in ip6_xmit()\\n\\nIf skb_expand_head() returns NULL, skb has been freed\\nand the associated dst/idev could also have been freed.\\n\\nWe must use rcu_read_lock() to prevent a possible UAF.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: ipv6: evitar posible UAF en ip6_xmit() Si skb_expand_head() devuelve NULL, skb se ha liberado y el dst/idev asociado tambi\u00e9n podr\u00eda haberse liberado. Debemos utilizar rcu_read_lock() para evitar un posible UAF.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"81d626b00bdba16504eeae9cc891b18e83a9471a\",\"lessThan\":\"b3a3d5333c13a1be57499581eab4a8fc94d57f36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee6b1db17f8287b615448488fc37f42bcfe9ece6\",\"lessThan\":\"c47e022011719fc5727bca661d662303180535ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c9f227bee11910a49e1d159abe102d06e3745d5\",\"lessThan\":\"975f764e96f71616b530e300c1bb2ac0ce0c2596\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c9f227bee11910a49e1d159abe102d06e3745d5\",\"lessThan\":\"38a21c026ed2cc7232414cb166efc1923f34af17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c9f227bee11910a49e1d159abe102d06e3745d5\",\"lessThan\":\"124b428fe28064c809e4237b0b38e97200a8a4a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c9f227bee11910a49e1d159abe102d06e3745d5\",\"lessThan\":\"fc88d6c1f2895a5775795d82ec581afdff7661d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c9f227bee11910a49e1d159abe102d06e3745d5\",\"lessThan\":\"2d5ff7e339d04622d8282661df36151906d0e1c7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.166\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.107\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.48\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.7\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T01:05:42.699758Z\",\"id\":\"CVE-2024-44985\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.166\",\"matchCriteriaId\":\"1E86C365-0589-4961-B85C-B76395A12CC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.107\",\"matchCriteriaId\":\"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/124b428fe28064c809e4237b0b38e97200a8a4a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d5ff7e339d04622d8282661df36151906d0e1c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38a21c026ed2cc7232414cb166efc1923f34af17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:15+00:00",
      "cve": "CVE-2024-44985",
      "id": "CVE-2024-44985",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: prevent possible UAF in ip6_xmit()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44985.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:49:22Z",
      "cve": "CVE-2024-44985",
      "id": "CVE-2024-44985",
      "initial_release_date": "2024-09-05T02:46:39Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "432",
      "product_status:recommended": "344",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44985",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44985.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:14:33.082Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44985\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T01:05:42.699758Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-10T01:05:43.844Z\"}}], \"cna\": {\"title\": \"ipv6: prevent possible UAF in ip6_xmit()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"81d626b00bdba16504eeae9cc891b18e83a9471a\", \"lessThan\": \"b3a3d5333c13a1be57499581eab4a8fc94d57f36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ee6b1db17f8287b615448488fc37f42bcfe9ece6\", \"lessThan\": \"c47e022011719fc5727bca661d662303180535ba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c9f227bee11910a49e1d159abe102d06e3745d5\", \"lessThan\": \"975f764e96f71616b530e300c1bb2ac0ce0c2596\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c9f227bee11910a49e1d159abe102d06e3745d5\", \"lessThan\": \"38a21c026ed2cc7232414cb166efc1923f34af17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c9f227bee11910a49e1d159abe102d06e3745d5\", \"lessThan\": \"124b428fe28064c809e4237b0b38e97200a8a4a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c9f227bee11910a49e1d159abe102d06e3745d5\", \"lessThan\": \"fc88d6c1f2895a5775795d82ec581afdff7661d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c9f227bee11910a49e1d159abe102d06e3745d5\", \"lessThan\": \"2d5ff7e339d04622d8282661df36151906d0e1c7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv6/ip6_output.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv6/ip6_output.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36\"}, {\"url\": \"https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba\"}, {\"url\": \"https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596\"}, {\"url\": \"https://git.kernel.org/stable/c/38a21c026ed2cc7232414cb166efc1923f34af17\"}, {\"url\": \"https://git.kernel.org/stable/c/124b428fe28064c809e4237b0b38e97200a8a4a8\"}, {\"url\": \"https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1\"}, {\"url\": \"https://git.kernel.org/stable/c/2d5ff7e339d04622d8282661df36151906d0e1c7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: prevent possible UAF in ip6_xmit()\\n\\nIf skb_expand_head() returns NULL, skb has been freed\\nand the associated dst/idev could also have been freed.\\n\\nWe must use rcu_read_lock() to prevent a possible UAF.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:33:14.202Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44985\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:33:14.202Z\", \"dateReserved\": \"2024-08-21T05:34:56.670Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T19:54:34.188Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.