high CVSS 7.8 Actively exploited EPSS 0.49%

CVE-2024-36971·Kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

Severity
high
Software
Kernel
Fixed in
6.9.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.49% — higher than 66% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2024-36971 scores 7.8 on CVSS, so a successful attack would be serious — but at 0.49%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 6.7

Until: 6.9.4

Fixed in: 6.9.4

How to fix this CVE

Update the Linux kernel to version 6.9.4 or later. For LTS kernels, apply the backported patch from your distribution. If immediate kernel update is not possible, limit local user access and monitor for suspicious network-related syscalls. A reboot is required after kernel update.

sudo apt update && sudo apt install --only-upgrade linux-image-generic
# Verify: uname -r (should show patched version)
sudo reboot
# For specific kernel: apt list --installed 2>/dev/null | grep linux-image

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

This is a local privilege escalation via kernel memory corruption. The attack exploits a race condition in __dst_negative_advice() where sk->sk_dst_cache is released before being cleared, allowing a use-after-free. Exploitation requires local access and typically involves creating UDP sockets with specific routing configurations to trigger the race window.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

WAF rules cannot mitigate kernel vulnerabilities as they operate at the application layer. Mitigation strategies include: restrict local user access, use kernel hardening (KASLR, SMEP, SMAP), deploy seccomp profiles to limit syscalls, and ensure rapid kernel patching cycles.

How to check if you are affected

  1. Check kernel version: uname -r — vulnerable if 6.7.x through 6.9.3
  2. Check distribution patch level: apt list --installed 2>/dev/null | grep linux-image || rpm -q kernel
  3. Monitor for exploitation: dmesg | grep -i 'use.after.free\|kasan\|slab.out.of.bounds'
  4. Check for suspicious UDP socket activity: ss -unap | grep -v ESTABLISHED
  5. Audit local users with shell access: awk -F: '$7 ~ /bash|sh/' /etc/passwd

Indicators of compromise

  • Kernel KASAN reports mentioning __dst_negative_advice or dst_release
  • Unexpected kernel oops/panics related to network routing
  • Suspicious processes running with elevated privileges after exploiting local access
  • High volume of UDP socket creation/destruction patterns

FAQ

Can this be exploited remotely?

No. CVE-2024-36971 requires local access to the system. The attacker needs to be able to create and manipulate UDP sockets, which requires local user privileges. However, an attacker who has gained initial access through another vulnerability (e.g., a web shell) could use this for privilege escalation.

Does this affect all Linux distributions?

It affects distributions running kernel versions 6.7 through 6.9.3. Many enterprise distributions (RHEL, Ubuntu LTS) may run older LTS kernels that are not affected by this specific commit range, but check your distribution's security advisories for backported patches.

Is a reboot required after patching?

Yes. Kernel updates require a reboot to take effect. Consider using kexec for faster reboots on production servers, or schedule a maintenance window. Live patching services (Canonical Livepatch, RHEL kpatch) may provide a patch without reboot.

Who discovered this vulnerability?

Clement Lecigne of Google's Threat Analysis Group (TAG) reported this vulnerability, which typically indicates it was discovered being exploited in targeted attacks. Google TAG primarily tracks state-sponsored threat actors.

How does this relate to the network stack?

The vulnerability is in the destination cache negative advice handling. When a route becomes invalid, __dst_negative_advice() should safely clear and release the cached destination. The bug is an incorrect ordering of operations — releasing before clearing — that creates a use-after-free race condition exploitable via UDP sockets.

Related Kernel CVEs

CVE-2026-63795CVSS 10In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.
CVE-2026-64160CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.
CVE-2026-64125CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.
CVE-2026-64136CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().
CVE-2026-53399CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-36971. Free for 1 server.

Get started free