CVE-2024-40920CWE-416

CVE-2024-40920

High · published July 12, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: fix suspicious rcu usage in br_mst_set_state

I converted br_mst_set_state to RCU to avoid a vlan use-after-free

but forgot to change the vlan group dereference helper. Switch to vlan

group RCU deref helper to fix the suspicious rcu usage warning.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00417 · 35.0th percentile
Weakness
CWE-416 · Use After Free
Published
2024-07-12T17:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.93, < 6.1.956.1.95
linux/linux_kernel≥ 6.6.33, < 6.6.356.6.35
linux/linux_kernel≥ 6.8.12, < 6.96.9
linux/linux_kernel≥ 6.9.3, < 6.9.66.9.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (9)
EPSS history
Timeline
  • 12 JUL 12:25Z
    net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
    cvelistv5