CVE-2024-44974
Status: ModifiedHigh (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: avoid possible UaF when selecting endp
select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free.
A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.27%
- Percentile among all scored CVEs: 18
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-416
References
- https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f
- https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1
- https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d
- https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8
- https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1
- https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Raw JSON (NVD)
Show
{
"id": "CVE-2024-44974",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-44974",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-09-10T15:26:21.490934Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"versionType": "git"
},
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"versionType": "git"
},
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "2b4f46f9503633dade75cb796dd1949d0e6581a1",
"versionType": "git"
},
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8",
"versionType": "git"
},
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "0201d65d9806d287a00e0ba96f0321835631f63f",
"versionType": "git"
},
{
"status": "affected",
"version": "01cacb00b35cb62b139f07d5f84bcf0eeda8eff6",
"lessThan": "48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"versionType": "git"
}
],
"programFiles": [
"net/mptcp/pm_netlink.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.226",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.167",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.109",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.48",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.7",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mptcp/pm_netlink.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2024-09-04T20:15:07.100",
"references": [
{
"url": "https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: avoid possible UaF when selecting endp\n\nselect_local_address() and select_signal_address() both select an\nendpoint entry from the list inside an RCU protected section, but return\na reference to it, to be read later on. If the entry is dereferenced\nafter the RCU unlock, reading info could cause a Use-after-Free.\n\nA simple solution is to copy the required info while inside the RCU\nprotected section to avoid any risk of UaF later. The address ID might\nneed to be modified later to handle the ID0 case later, so a copy seems\nOK to deal with."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: pm: evitar posible UaF al seleccionar endp select_local_address() y select_signal_address() seleccionan una entrada de endpoint de la lista dentro de una sección protegida de RCU, pero devuelven una referencia a ella, para leerla más tarde. Si se desreferencia la entrada después del desbloqueo de RCU, leer información podría causar un Use-after-Free. Una solución simple es copiar la información requerida mientras se está dentro de la sección protegida de RCU para evitar cualquier riesgo de UaF más adelante. Es posible que el ID de la dirección deba modificarse más tarde para manejar el caso ID0 más tarde, por lo que una copia parece ser una buena opción."
}
],
"lastModified": "2026-08-04T11:20:05.717",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38ED0DCC-BFFE-4561-A649-90A221FACA09",
"versionEndExcluding": "5.10.226",
"versionStartIncluding": "5.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "043405A4-25FE-45D4-A7BB-2A0C3B7D17C1",
"versionEndExcluding": "5.15.167",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "790F505A-7933-48F1-B038-380A8BC5C153",
"versionEndExcluding": "6.1.109",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DE9201A-CE6B-4726-BABB-8265EA0F8AE4",
"versionEndExcluding": "6.6.48",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2AFDFD1-D95A-4EB7-843B-5E7659518B67",
"versionEndExcluding": "6.10.7",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}