CVE-2024-44985

ipv6: prevent possible UAF in ip6_xmit()

HIGH

7.8

CVSS Score

Published: September 4, 2024 at 07:54 PM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.15 ≤ v < 5.15.1665.15 ≤ v < 6.1.1075.15 ≤ v < 6.10.75.15 ≤ v < 6.115.15 ≤ v < 6.6.485.16 ≤ v < 6.1.1076.2 ≤ v < 6.6.486.7 ≤ v < 6.10.70c9f227bee11910a49e1d159abe102d06e3745d56.11 rc1 6.11 rc2 6.11 rc3 6.11 rc481d626b00bdba16504eeae9cc891b18e83a9471aee6b1db17f8287b615448488fc37f42bcfe9ece6

Vendor states this is fixed in 124b428fe28064c809e4237b0b38e97200a8a4a8 (fixed)

Vendor states this is fixed in 2d5ff7e339d04622d8282661df36151906d0e1c7 (fixed)

Vendor states this is fixed in 38a21c026ed2cc7232414cb166efc1923f34af17 (fixed)

Vendor states this is fixed in 975f764e96f71616b530e300c1bb2ac0ce0c2596 (fixed)

Vendor states this is fixed in b3a3d5333c13a1be57499581eab4a8fc94d57f36 (fixed)

Vendor states this is fixed in c47e022011719fc5727bca661d662303180535ba (fixed)

Vendor states this is fixed in fc88d6c1f2895a5775795d82ec581afdff7661d1 (fixed)

Vendor states this is fixed in 5.15 (unaffected)

Vendor states this is fixed in 5.15.166 (unaffected)

Vendor states this is fixed in 6.1.107 (unaffected)

Vendor states this is fixed in 6.10.7 (unaffected)

Vendor states this is fixed in 6.11 (unaffected)