CVE-2024-50036: Linux Kernel

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.

Affected products

• Linux Linux Kernel: from 3.10.50, before 3.11 (fixed in 3.11); from 3.12.26, before 3.13 (fixed in 3.13); from 3.14.14, before 3.15 (fixed in 3.15); from 3.15.7, before 3.16 (fixed in 3.16); from 3.16, before 6.6.57 (fixed in 6.6.57); from 6.7, before 6.11.4 (fixed in 6.11.4); …

Published 2024-10-21. Last modified 2026-08-04.