CVE-2024-44945·Kernel vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 9% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2024-44945 scores 7.8 on CVSS, so a successful attack would be serious — but at <0.1%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Update your Linux kernel to version 6.10.7 or later to address a netfilter ACK handling vulnerability that can lead to uninitialized memory exposure. This issue affects systems running kernels 6.10 through 6.10.6 where netfilter batch operations fail to properly initialize error tracking structures, potentially allowing local privilege escalation. Apply the kernel update through your distribution's package manager and reboot to complete remediation.

sudo dnf update kernel && sudo reboot

How to check if you are affected

1. Step 1: Check kernel version with: uname -r — verify if it falls within 6.10.0 to 6.10.6 range
2. Step 2: Confirm netfilter is loaded: lsmod | grep nf_conntrack — if module is present, netfilter is active and vulnerable code paths are loaded
3. Step 3: Search system logs for netfilter batch operations: grep -i 'BATCH_BEGIN\|BATCH_END' /var/log/kernel.log or journalctl -k | grep -i batch
4. Step 4: Verify patch application post-reboot: uname -r should show 6.10.7 or later, and compare loaded kernel modules hash: cat /sys/module/nf_conntrack/srcversion

FAQ

Related Kernel CVEs

References

• https://git.kernel.org/stable/c/3e03b536d9454c5802168b9e85248d456d3ff6a3
• https://git.kernel.org/stable/c/d1a7b382a9d3f0f3e5a80e0be2991c075fa4f618