CVE-2024-49982 (GCVE-0-2024-49982)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-08-05 11:40
VLAI
Title
aoe: fix the potential use-after-free problem in more places
Summary
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ad80c34944d7175fa1f5c7a55066020002921a99 , < 12f7b89dd72b25da4eeaa22097877963cad6418e (git)
Affected: 1a54aa506b3b2f31496731039e49778f54eee881 , < a786265aecf39015418e4f930cc1c14603a01490 (git)
Affected: faf0b4c5e00bb680e8e43ac936df24d3f48c8e65 , < f63461af2c1a86af4217910e47a5c46e3372e645 (git)
Affected: 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4 , < 07b418d50ccbbca7e5d87a3a0d41d436cefebf79 (git)
Affected: 74ca3ef68d2f449bc848c0a814cefc487bf755fa , < bc2cbf7525ac288e07d465f5a1d8cb8fb9599254 (git)
Affected: eb48680b0255a9e8a9bdc93d6a55b11c31262e62 , < acc5103a0a8c200a52af7d732c36a8477436a3d3 (git)
Affected: f98364e926626c678fb4b9004b75cacf92ff0662 , < 89d9a69ae0c667e4d9d028028e2dcc837bae626f (git)
Affected: f98364e926626c678fb4b9004b75cacf92ff0662 , < 8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58 (git)
Affected: f98364e926626c678fb4b9004b75cacf92ff0662 , < 6d6e54fc71ad1ab0a87047fd9c211e75d86084a3 (git)
Affected: 079cba4f4e307c69878226fdf5228c20aa1c969c (git)
Affected: a16fbb80064634b254520a46395e36b87ca4731e (git)
Affected: 4.19.311 , < 4.19.323 (semver)
Affected: 5.4.273 , < 5.4.285 (semver)
Affected: 5.10.214 , < 5.10.227 (semver)
Affected: 5.15.153 , < 5.15.168 (semver)
Affected: 6.1.83 , < 6.1.113 (semver)
Affected: 6.6.23 , < 6.6.55 (semver)
Affected: 6.7.11 , < 6.8 (semver)
Affected: 6.8.2 , < 6.9 (semver)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 4.19.323 , ≤ 4.19.* (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:22.974285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:44.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:03.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/aoe/aoecmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12f7b89dd72b25da4eeaa22097877963cad6418e",
              "status": "affected",
              "version": "ad80c34944d7175fa1f5c7a55066020002921a99",
              "versionType": "git"
            },
            {
              "lessThan": "a786265aecf39015418e4f930cc1c14603a01490",
              "status": "affected",
              "version": "1a54aa506b3b2f31496731039e49778f54eee881",
              "versionType": "git"
            },
            {
              "lessThan": "f63461af2c1a86af4217910e47a5c46e3372e645",
              "status": "affected",
              "version": "faf0b4c5e00bb680e8e43ac936df24d3f48c8e65",
              "versionType": "git"
            },
            {
              "lessThan": "07b418d50ccbbca7e5d87a3a0d41d436cefebf79",
              "status": "affected",
              "version": "7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4",
              "versionType": "git"
            },
            {
              "lessThan": "bc2cbf7525ac288e07d465f5a1d8cb8fb9599254",
              "status": "affected",
              "version": "74ca3ef68d2f449bc848c0a814cefc487bf755fa",
              "versionType": "git"
            },
            {
              "lessThan": "acc5103a0a8c200a52af7d732c36a8477436a3d3",
              "status": "affected",
              "version": "eb48680b0255a9e8a9bdc93d6a55b11c31262e62",
              "versionType": "git"
            },
            {
              "lessThan": "89d9a69ae0c667e4d9d028028e2dcc837bae626f",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            },
            {
              "lessThan": "8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            },
            {
              "lessThan": "6d6e54fc71ad1ab0a87047fd9c211e75d86084a3",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "079cba4f4e307c69878226fdf5228c20aa1c969c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a16fbb80064634b254520a46395e36b87ca4731e",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.323",
              "status": "affected",
              "version": "4.19.311",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.285",
              "status": "affected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.227",
              "status": "affected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.168",
              "status": "affected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.113",
              "status": "affected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.55",
              "status": "affected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/aoe/aoecmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "4.19.311",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.4.273",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.10.214",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.15.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "6.1.83",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "6.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in more places\n\nFor fixing CVE-2023-6270, f98364e92662 (\"aoe: fix the potential\nuse-after-free problem in aoecmd_cfg_pkts\") makes tx() calling dev_put()\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\ninto use-after-free.\n\nThen Nicolai Stange found more places in aoe have potential use-after-free\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\npacket to tx queue. So they should also use dev_hold() to increase the\nrefcnt of skb-\u003edev.\n\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\nskb-\u003edev be reduced to a negative value, because corresponding\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The strongest path is `aoenet_rcv()` \u2192 `aoecmd_cfg_rsp()` \u2192 `aoecmd_ata_id()`, driven purely by a received AoE frame; AoE is a raw EtherType-0x88A2 Layer-2 protocol with no IP encapsulation, so the attacker must be on the same Ethernet/LAN segment (SAN VLAN, cloud L2 network, shared switch).\nAC:L - The refcount underflow is deterministic \u2014 one leaked `dev_put()` per transmitted packet with no race to win \u2014 and the attacker fully controls the trigger rate by injecting AoE config responses (and the retransmit timer keeps draining references autonomously afterwards).\nPR:N - `aoecmd_cfg_rsp()` is invoked from the packet handler on unsolicited frames with zero authentication, and it auto-allocates an aoedev and target from attacker-supplied shelf/slot/MAC, so no credentials or local account are needed.\nUI:N - The vulnerable code runs in softirq/packet-receive and timer context as soon as the frame arrives; no administrator or user action is required beyond the aoe driver being loaded.\nS:U - The corrupted `struct net_device` and the resulting memory corruption are entirely within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Premature free of a live `struct net_device` yields a use-after-free on a large, widely-referenced kernel object that can be reclaimed and re-sprayed by the attacker, giving an arbitrary kernel-memory read primitive and disclosure of adjacent slab contents.\nI:H - The same UAF permits reallocating the freed `net_device` with attacker-controlled data, corrupting embedded function pointers (`net_device_ops`, `header_ops`) for a write/control-flow-hijack primitive leading to arbitrary kernel code execution.\nA:H - Even without exploitation, the negative refcount trips `BUG_ON(netdev_refcnt_read(dev) != 1)` in `free_netdev()` and causes use-after-free dereferences of the freed device in the transmit path, producing a kernel oops/panic that is trivially reproducible by an unauthenticated LAN host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:51.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490"
        },
        {
          "url": "https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645"
        },
        {
          "url": "https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254"
        },
        {
          "url": "https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3"
        }
      ],
      "title": "aoe: fix the potential use-after-free problem in more places",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49982",
    "datePublished": "2024-10-21T18:02:27.820Z",
    "dateReserved": "2024-10-21T12:17:06.052Z",
    "dateUpdated": "2026-08-05T11:40:51.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49982",
      "date": "2026-08-05",
      "epss": "0.00376",
      "percentile": "0.30346"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.214\", \"versionEndExcluding\": \"5.10.227\", \"matchCriteriaId\": \"A8846BE7-5AEC-4A74-8E34-0FE8B1205194\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.153\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"41952CCA-3B42-425D-A5FF-DE2474EC8369\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.83\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"161F9759-367F-4944-B666-215896634DCA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6.23\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"45944AD8-B4B6-4255-83BA-8A6750FEE47B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7.11\", \"versionEndExcluding\": \"6.8.2\", \"matchCriteriaId\": \"2DF20568-DF11-4303-9FA2-3DA7F6C84BD3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"158EBA02-95B5-4E0A-85BC-1EAC91B085F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:4.19.311:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70FB9763-2A30-46A0-8FC0-C8152849C55A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:5.4.273:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"517FA340-6242-490E-A71D-B855DEF4C620\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naoe: fix the potential use-after-free problem in more places\\n\\nFor fixing CVE-2023-6270, f98364e92662 (\\\"aoe: fix the potential\\nuse-after-free problem in aoecmd_cfg_pkts\\\") makes tx() calling dev_put()\\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\\ninto use-after-free.\\n\\nThen Nicolai Stange found more places in aoe have potential use-after-free\\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\\npacket to tx queue. So they should also use dev_hold() to increase the\\nrefcnt of skb-\u003edev.\\n\\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\\nskb-\u003edev be reduced to a negative value, because corresponding\\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aoe: soluciona el posible problema de use-after-free en m\\u00e1s lugares Para solucionar CVE-2023-6270, f98364e92662 (\\\"aoe: soluciona el posible problema de use-after-free en aoecmd_cfg_pkts\\\") hace que tx() llame a dev_put() en lugar de hacerlo en aoecmd_cfg_pkts(). Esto evita que tx() se ejecute en use-after-free. Luego, Nicolai Stange encontr\\u00f3 que m\\u00e1s lugares en aoe tienen un posible problema de use-after-free con tx(). Por ejemplo, revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Esas funciones tambi\\u00e9n usan aoenet_xmit() para enviar paquetes a la cola de tx. Por lo tanto, tambi\\u00e9n deber\\u00edan usar dev_hold() para aumentar el refcnt de skb-\u0026gt;dev. Por otra parte, mover dev_put() a tx() hace que el refcnt de skb-\u0026gt;dev se reduzca a un valor negativo, porque los dev_hold() correspondientes no se llaman en revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Este parche solucion\\u00f3 este problema.\"}]",
      "id": "CVE-2024-49982",
      "lastModified": "2024-11-08T16:15:39.680",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T18:15:18.733",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:01:35.000Z",
      "cve": "CVE-2024-49982",
      "id": "msrc_CVE-2024-49982",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "aoe: fix the potential use-after-free problem in more places",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49982.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49982\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:18.733\",\"lastModified\":\"2026-08-04T11:21:05.137\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naoe: fix the potential use-after-free problem in more places\\n\\nFor fixing CVE-2023-6270, f98364e92662 (\\\"aoe: fix the potential\\nuse-after-free problem in aoecmd_cfg_pkts\\\") makes tx() calling dev_put()\\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\\ninto use-after-free.\\n\\nThen Nicolai Stange found more places in aoe have potential use-after-free\\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\\npacket to tx queue. So they should also use dev_hold() to increase the\\nrefcnt of skb-\u003edev.\\n\\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\\nskb-\u003edev be reduced to a negative value, because corresponding\\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aoe: soluciona el posible problema de use-after-free en m\u00e1s lugares Para solucionar CVE-2023-6270, f98364e92662 (\\\"aoe: soluciona el posible problema de use-after-free en aoecmd_cfg_pkts\\\") hace que tx() llame a dev_put() en lugar de hacerlo en aoecmd_cfg_pkts(). Esto evita que tx() se ejecute en use-after-free. Luego, Nicolai Stange encontr\u00f3 que m\u00e1s lugares en aoe tienen un posible problema de use-after-free con tx(). Por ejemplo, revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Esas funciones tambi\u00e9n usan aoenet_xmit() para enviar paquetes a la cola de tx. Por lo tanto, tambi\u00e9n deber\u00edan usar dev_hold() para aumentar el refcnt de skb-\u0026gt;dev. Por otra parte, mover dev_put() a tx() hace que el refcnt de skb-\u0026gt;dev se reduzca a un valor negativo, porque los dev_hold() correspondientes no se llaman en revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Este parche solucion\u00f3 este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/block/aoe/aoecmd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ad80c34944d7175fa1f5c7a55066020002921a99\",\"lessThan\":\"12f7b89dd72b25da4eeaa22097877963cad6418e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1a54aa506b3b2f31496731039e49778f54eee881\",\"lessThan\":\"a786265aecf39015418e4f930cc1c14603a01490\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faf0b4c5e00bb680e8e43ac936df24d3f48c8e65\",\"lessThan\":\"f63461af2c1a86af4217910e47a5c46e3372e645\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4\",\"lessThan\":\"07b418d50ccbbca7e5d87a3a0d41d436cefebf79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74ca3ef68d2f449bc848c0a814cefc487bf755fa\",\"lessThan\":\"bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb48680b0255a9e8a9bdc93d6a55b11c31262e62\",\"lessThan\":\"acc5103a0a8c200a52af7d732c36a8477436a3d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f98364e926626c678fb4b9004b75cacf92ff0662\",\"lessThan\":\"89d9a69ae0c667e4d9d028028e2dcc837bae626f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f98364e926626c678fb4b9004b75cacf92ff0662\",\"lessThan\":\"8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f98364e926626c678fb4b9004b75cacf92ff0662\",\"lessThan\":\"6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"079cba4f4e307c69878226fdf5228c20aa1c969c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a16fbb80064634b254520a46395e36b87ca4731e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.311\",\"lessThan\":\"4.19.323\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.273\",\"lessThan\":\"5.4.285\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.214\",\"lessThan\":\"5.10.227\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.153\",\"lessThan\":\"5.15.168\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.83\",\"lessThan\":\"6.1.113\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.23\",\"lessThan\":\"6.6.55\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.11\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.8.2\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/block/aoe/aoecmd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:32:22.974285Z\",\"id\":\"CVE-2024-49982\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.214\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"A8846BE7-5AEC-4A74-8E34-0FE8B1205194\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.153\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"41952CCA-3B42-425D-A5FF-DE2474EC8369\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.83\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"161F9759-367F-4944-B666-215896634DCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.23\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"45944AD8-B4B6-4255-83BA-8A6750FEE47B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.11\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"2DF20568-DF11-4303-9FA2-3DA7F6C84BD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"158EBA02-95B5-4E0A-85BC-1EAC91B085F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.19.311:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70FB9763-2A30-46A0-8FC0-C8152849C55A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.4.273:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"517FA340-6242-490E-A71D-B855DEF4C620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:45+00:00",
      "cve": "CVE-2024-49982",
      "id": "CVE-2024-49982",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: aoe: fix the potential use-after-free problem in more places",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49982.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:30:46Z",
      "cve": "CVE-2024-49982",
      "id": "CVE-2024-49982",
      "initial_release_date": "2024-10-25T03:06:46Z",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "134",
      "product_status:recommended": "893",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49982",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49982.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:03.908Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:32:22.974285Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:32:26.019Z\"}}], \"cna\": {\"title\": \"aoe: fix the potential use-after-free problem in more places\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ad80c34944d7175fa1f5c7a55066020002921a99\", \"lessThan\": \"12f7b89dd72b25da4eeaa22097877963cad6418e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1a54aa506b3b2f31496731039e49778f54eee881\", \"lessThan\": \"a786265aecf39015418e4f930cc1c14603a01490\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"faf0b4c5e00bb680e8e43ac936df24d3f48c8e65\", \"lessThan\": \"f63461af2c1a86af4217910e47a5c46e3372e645\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4\", \"lessThan\": \"07b418d50ccbbca7e5d87a3a0d41d436cefebf79\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ca3ef68d2f449bc848c0a814cefc487bf755fa\", \"lessThan\": \"bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eb48680b0255a9e8a9bdc93d6a55b11c31262e62\", \"lessThan\": \"acc5103a0a8c200a52af7d732c36a8477436a3d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e926626c678fb4b9004b75cacf92ff0662\", \"lessThan\": \"89d9a69ae0c667e4d9d028028e2dcc837bae626f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e926626c678fb4b9004b75cacf92ff0662\", \"lessThan\": \"8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e926626c678fb4b9004b75cacf92ff0662\", \"lessThan\": \"6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"079cba4f4e307c69878226fdf5228c20aa1c969c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a16fbb80064634b254520a46395e36b87ca4731e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.311\", \"lessThan\": \"4.19.323\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.273\", \"lessThan\": \"5.4.285\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.214\", \"lessThan\": \"5.10.227\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.153\", \"lessThan\": \"5.15.168\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.83\", \"lessThan\": \"6.1.113\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.23\", \"lessThan\": \"6.6.55\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.11\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.8.2\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/block/aoe/aoecmd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/block/aoe/aoecmd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e\"}, {\"url\": \"https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490\"}, {\"url\": \"https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645\"}, {\"url\": \"https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79\"}, {\"url\": \"https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\"}, {\"url\": \"https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3\"}, {\"url\": \"https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f\"}, {\"url\": \"https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\"}, {\"url\": \"https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naoe: fix the potential use-after-free problem in more places\\n\\nFor fixing CVE-2023-6270, f98364e92662 (\\\"aoe: fix the potential\\nuse-after-free problem in aoecmd_cfg_pkts\\\") makes tx() calling dev_put()\\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\\ninto use-after-free.\\n\\nThen Nicolai Stange found more places in aoe have potential use-after-free\\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\\npacket to tx queue. So they should also use dev_hold() to increase the\\nrefcnt of skb-\u003edev.\\n\\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\\nskb-\u003edev be reduced to a negative value, because corresponding\\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"4.19.311\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"5.4.273\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"5.10.214\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.15.153\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"6.1.83\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"6.6.23\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.7.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:14.068Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49982\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:14.068Z\", \"dateReserved\": \"2024-10-21T12:17:06.052Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:27.820Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.