{"id":"CVE-2024-36971","kind":"vulnerability","aliases":["CVE-2024-36971"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk->dst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk->sk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three ->negative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets.","summary":"An unspecified flaw in the Android kernel (Linux kernel code) allows remote code execution. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-08-07T00:00:00+00:00","products":[{"name":"Android Kernel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.19.316"],"affected":">= 4.6, < 4.19.316","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.4.278"],"affected":">= 4.20, < 5.4.278","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.219"],"affected":">= 5.5, < 5.10.219","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.161"],"affected":">= 5.11, < 5.15.161","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.94"],"affected":">= 5.16, < 6.1.94","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.34"],"affected":">= 6.2, < 6.6.34","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.9.4"],"affected":">= 6.7, < 6.9.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","linux-kernel"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations per vendor instructions (Android security bulletin); if unavailable, discontinue use of the affected product per CISA's required action.","status":"open","published_at":"2024-06-10T09:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:27+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per vendor instructions (Android security bulletin); if unavailable, discontinue use of the affected product per CISA's required action.","reach":"unknown","impact":"high","summary":"An unspecified flaw in the Android kernel (Linux kernel code) allows remote code execution. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["android","linux-kernel"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code remotely with kernel privileges on the device","analyst_note":"Find the Android security bulletin entry for CVE-2024-36971 and the patched Android patch level, plus the attack vector and affected kernel versions; the KEV entry gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2816,"output_tokens":339,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':18A,21A '-36971':19A,22A 'activ':65B 'advic':15A,84C,88C,138C,147C,161C,182C 'allow':57B 'android':23A,41B,52B 'becam':205C 'blame':209C 'bug':204C 'cach':98C,117C,153C 'call':119C 'callback':192C 'central':178C 'check':173C 'cisa':61B 'clear':101C,113C 'clement':196C 'code':56B,59B 'commit':210C 'correct':134C 'cve':17A,20A 'debian':25A 'dst':13A,82C,86C,97C,116C,120C,123C,127C,136C,168C,176C,180C 'duplic':188C 'enforc':91C 'execut':60B 'exist':162C 'exploit':42B,66B 'first':112C 'fix':12A,81C 'flaw':49B 'follow':6A,75C 'given':143C 'implement':131C 'infrastructur':43B 'ip6':145C 'issu':201C 'kernel':4A,24A,28A,30A,32A,34A,36A,38A,40A,46B,53B,55B,73C 'lead':102C 'lecign':197C 'linux':3A,26A,27A,29A,31A,33A,35A,37A,39A,45B,54B,72C 'linux-kernel':44B 'list':62B 'logic':150C 'mani':193C 'mean':155C 'method':163C 'must':99C,111C,164C 'need':186C 'negat':14A,83C,87C,137C,146C,160C,181C 'net':11A,80C 'note':124C,171C 'null':175C 'old':122C,203C 'order':142C 'perform':165C 'possibl':104C 'proper':92C 'protocol':133C 'race':16A,85C 'rcu':93C,106C 'releas':121C 'remot':58B 'reset':128C,169C 'resolv':10A,79C 'rtf':152C 'rule':94C,107C 'sk':96C,114C,115C,126C,129C,167C 'socket':213C 'special':149C 'thank':194C 'three':159C 'track':199C 'uaf':105C 'udp':212C 'unspecifi':48B 'use':139C,211C 'various':191C 'visibl':206C 'vulner':7A,76C 'wild':69B 'wrong':141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-06-10T09:15:09+00:00","kev":{"dateAdded":"2024-08-07","dueDate":"2024-08-28","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-36971","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-36971","severity":null,"published_at":"2024-08-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-36971","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36971","severity":null,"published_at":"2024-06-10T09:15:09+00:00","modified_at":"2026-06-17T07:37:30+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}