CVE-2024-49945CWE-416

CVE-2024-49945

Medium · published October 21, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/ncsi: Disable the ncsi work before freeing the associated structure

The work function can run after the ncsi device is freed, resulting

in use-after-free bugs or kernel panic.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-416 · Use After Free
Published
2024-10-21T22:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 4.8, < 6.10.146.10.14
linux/linux_kernel≥ 6.11, < 6.11.36.11.3
linux/linux_kernelall versions—
References (4)
https://git.kernel.org/stable/c/64704f231d5dee8639e256507178f43dde1f131c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a0ffa68c70b367358b2672cdab6fa5bc4c40de2c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd41dab62f32d9e9e0669af8459d12a93834b238 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f6ca58696749268181f43150b3553f2bafd71e42 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 21 OCT 18:02Z
    net/ncsi: Disable the ncsi work before freeing the associated structure
    cvelistv5