Use-after-free in Linux kernel - CVE-2024-50226

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU100167

Use-after-free in Linux kernel - CVE-2024-50226

Published: November 10, 2024 / Updated: May 12, 2025


Vulnerability identifier: #VU100167
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-50226
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mock_decoder_commit() function in tools/testing/cxl/test/cxl.c, within the cxl_region_invalidate_memregion(), cxl_region_decode_reset(), commit_store() and cxl_region_detach() functions in drivers/cxl/core/region.c, within the cxl_decoder_commit() and cxl_decoder_reset() functions in drivers/cxl/core/hdm.c, within the device_for_each_child_reverse() function in drivers/base/core.c. A local user can escalate privileges on the system.


Affected software

Linux kernel
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
linux-image-realtime-hwe-24.04 (Ubuntu package)
linux-image-realtime (Ubuntu package)
linux-image-6.8.1-1020-realtime (Ubuntu package)
kernel (Red Hat package)
kernel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
linux-image-virtual (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-6.8.0-58-lowlatency-64k (Ubuntu package)
linux-image-6.8.0-58-lowlatency (Ubuntu package)
linux-image-6.8.0-58-generic-64k (Ubuntu package)
linux-image-6.8.0-58-generic (Ubuntu package)
linux-image-lowlatency-hwe-22.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-oem-22.04 (Ubuntu package)
linux-image-oem-22.04a (Ubuntu package)
linux-image-oem-22.04b (Ubuntu package)
linux-image-oem-22.04c (Ubuntu package)
linux-image-oem-22.04d (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-gkeop-6.8 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-6.8.0-1010-gkeop (Ubuntu package)
linux-image-azure-nvidia (Ubuntu package)
linux-image-6.8.0-1014-azure-nvidia (Ubuntu package)
linux-image-6.8.0-1023-gke (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-classic (Ubuntu package)
linux-image-ibm-lts-24.04 (Ubuntu package)
linux-image-6.8.0-1024-ibm (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-oracle-64k-lts-24.04 (Ubuntu package)
linux-image-oracle-lts-24.04 (Ubuntu package)
linux-image-oracle-64k (Ubuntu package)
linux-image-6.8.0-1024-oracle-64k (Ubuntu package)
linux-image-6.8.0-1024-oracle (Ubuntu package)
linux-image-6.8.0-1026-oem (Ubuntu package)
linux-image-oem-24.04 (Ubuntu package)
linux-image-oem-24.04a (Ubuntu package)
linux-image-6.8.0-1026-nvidia (Ubuntu package)
linux-image-6.8.0-1026-nvidia-64k (Ubuntu package)
linux-image-nvidia-64k (Ubuntu package)
linux-image-nvidia (Ubuntu package)
linux-image-nvidia-lowlatency-64k (Ubuntu package)
linux-image-6.8.0-1026-nvidia-lowlatency-64k (Ubuntu package)
linux-image-6.8.0-1026-nvidia-lowlatency (Ubuntu package)
linux-image-nvidia-lowlatency (Ubuntu package)
linux-image-nvidia-6.8 (Ubuntu package)
linux-image-nvidia-64k-hwe-22.04 (Ubuntu package)
linux-image-nvidia-64k-6.8 (Ubuntu package)
linux-image-nvidia-hwe-22.04 (Ubuntu package)
linux-image-6.8.0-1027-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-24.04 (Ubuntu package)
linux-image-azure-lts-24.04 (Ubuntu package)
linux-image-azure-fde-lts-24.04 (Ubuntu package)
linux-image-6.8.0-1027-azure (Ubuntu package)
linux-image-6.8.0-1027-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-6.8.0-1028-gcp (Ubuntu package)
linux-image-6.8.0-1028-gcp-64k (Ubuntu package)
linux-image-gcp-64k-lts-24.04 (Ubuntu package)
linux-image-gcp-lts-24.04 (Ubuntu package)
linux-image-gcp-64k (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-6.11.0-18-generic-64k (Ubuntu package)
linux-image-6.11.0-18-generic (Ubuntu package)
linux-image-generic-64k-hwe-24.04 (Ubuntu package)
linux-image-virtual-hwe-24.04 (Ubuntu package)
linux-image-generic-hwe-24.04 (Ubuntu package)
linux-image-6.11.0-1005-realtime (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-6.11.0-1008-raspi (Ubuntu package)
linux-image-6.11.0-1009-gcp (Ubuntu package)
linux-image-6.11.0-1009-azure (Ubuntu package)
linux-image-6.11.0-1009-azure-fde (Ubuntu package)
linux-image-6.11.0-1009-aws (Ubuntu package)
linux-image-6.11.0-1010-lowlatency (Ubuntu package)
linux-image-6.11.0-1010-lowlatency-64k (Ubuntu package)
linux-image-6.11.0-1011-oracle-64k (Ubuntu package)
linux-image-6.11.0-1011-oracle (Ubuntu package)
linux-image-6.11.0-1015-oem (Ubuntu package)
linux-image-oem-24.04b (Ubuntu package)
OpenShift Logging

How to mitigate CVE-2024-50226

Install update from vendor's website.

Linux kernel - addressed in versions 6.6.60, 6.11.7, 6.12
linux-image-realtime-hwe-24.04 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.11.0-1005.5
linux-image-realtime (Ubuntu package) - addressed in versions Ubuntu Pro, 6.11.0-1005.5
linux-image-6.8.1-1020-realtime (Ubuntu package) - update to Ubuntu Pro
OpenShift Logging - update to 5.8.16
kernel (Red Hat package) - update to 5.14.0-503.15.1.el9_5
kernel - update to 6.6.0-61.0.0.60
python3-perf-debuginfo - update to 6.6.0-61.0.0.60
python3-perf - update to 6.6.0-61.0.0.60
perf-debuginfo - update to 6.6.0-61.0.0.60
perf - update to 6.6.0-61.0.0.60
kernel-tools-devel - update to 6.6.0-61.0.0.60
kernel-tools-debuginfo - update to 6.6.0-61.0.0.60
kernel-tools - update to 6.6.0-61.0.0.60
kernel-source - update to 6.6.0-61.0.0.60
kernel-headers - update to 6.6.0-61.0.0.60
kernel-devel - update to 6.6.0-61.0.0.60
kernel-debugsource - update to 6.6.0-61.0.0.60
kernel-debuginfo - update to 6.6.0-61.0.0.60
bpftool-debuginfo - update to 6.6.0-61.0.0.60
bpftool - update to 6.6.0-61.0.0.60
linux-image-virtual (Ubuntu package) - addressed in versions 6.8.0-58.60, 6.11.0-18.18
linux-image-kvm (Ubuntu package) - update to 6.8.0-58.60
linux-image-generic (Ubuntu package) - addressed in versions 6.8.0-58.60, 6.11.0-18.18
linux-image-generic-64k (Ubuntu package) - addressed in versions 6.8.0-58.60, 6.11.0-18.18
linux-image-generic-lpae (Ubuntu package) - update to 6.8.0-58.60
linux-image-lowlatency-64k (Ubuntu package) - addressed in versions 6.8.0-58.60.1, 6.11.0-1010.11
linux-image-lowlatency (Ubuntu package) - addressed in versions 6.8.0-58.60.1, 6.11.0-1010.11
linux-image-6.8.0-58-lowlatency-64k (Ubuntu package) - addressed in versions 6.8.0-58.60.1, 6.8.0-58.60.1~22.04.1
linux-image-6.8.0-58-lowlatency (Ubuntu package) - addressed in versions 6.8.0-58.60.1, 6.8.0-58.60.1~22.04.1
linux-image-6.8.0-58-generic-64k (Ubuntu package) - addressed in versions 6.8.0-58.60+1, 6.8.0-58.60~22.04.1
linux-image-6.8.0-58-generic (Ubuntu package) - addressed in versions 6.8.0-58.60+1, 6.8.0-58.60~22.04.1
linux-image-lowlatency-hwe-22.04 (Ubuntu package) - update to 6.8.0-58.60.1~22.04.1
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package) - update to 6.8.0-58.60.1~22.04.1
linux-image-generic-hwe-22.04 (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-oem-22.04 (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-oem-22.04a (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-oem-22.04b (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-oem-22.04c (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-oem-22.04d (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 6.8.0-58.60~22.04.1
linux-image-gkeop-6.8 (Ubuntu package) - update to 6.8.0-1010.12
linux-image-gkeop (Ubuntu package) - update to 6.8.0-1010.12
linux-image-6.8.0-1010-gkeop (Ubuntu package) - update to 6.8.0-1010.12
linux-image-azure-nvidia (Ubuntu package) - update to 6.8.0-1014.15
linux-image-6.8.0-1014-azure-nvidia (Ubuntu package) - update to 6.8.0-1014.15
linux-image-6.8.0-1023-gke (Ubuntu package) - update to 6.8.0-1023.27
linux-image-gke (Ubuntu package) - update to 6.8.0-1023.27
linux-image-ibm (Ubuntu package) - update to 6.8.0-1024.24
linux-image-ibm-classic (Ubuntu package) - update to 6.8.0-1024.24
linux-image-ibm-lts-24.04 (Ubuntu package) - update to 6.8.0-1024.24
linux-image-6.8.0-1024-ibm (Ubuntu package) - update to 6.8.0-1024.24
linux-image-oracle (Ubuntu package) - addressed in versions 6.8.0-1024.25, 6.8.0-1024.25~22.04.1, 6.11.0-1011.12
linux-image-oracle-64k-lts-24.04 (Ubuntu package) - update to 6.8.0-1024.25
linux-image-oracle-lts-24.04 (Ubuntu package) - update to 6.8.0-1024.25
linux-image-oracle-64k (Ubuntu package) - addressed in versions 6.8.0-1024.25, 6.8.0-1024.25~22.04.1, 6.11.0-1011.12
linux-image-6.8.0-1024-oracle-64k (Ubuntu package) - addressed in versions 6.8.0-1024.25, 6.8.0-1024.25~22.04.1
linux-image-6.8.0-1024-oracle (Ubuntu package) - addressed in versions 6.8.0-1024.25, 6.8.0-1024.25~22.04.1
linux-image-6.8.0-1026-oem (Ubuntu package) - update to 6.8.0-1026.26
linux-image-oem-24.04 (Ubuntu package) - addressed in versions 6.8.0-1026.26, 6.11.0-18.18
linux-image-oem-24.04a (Ubuntu package) - addressed in versions 6.8.0-1026.26, 6.11.0-18.18
linux-image-6.8.0-1026-nvidia (Ubuntu package) - addressed in versions 6.8.0-1026.29, 6.8.0-1026.29~22.04.1
linux-image-6.8.0-1026-nvidia-64k (Ubuntu package) - addressed in versions 6.8.0-1026.29, 6.8.0-1026.29~22.04.1
linux-image-nvidia-64k (Ubuntu package) - update to 6.8.0-1026.29
linux-image-nvidia (Ubuntu package) - update to 6.8.0-1026.29
linux-image-nvidia-lowlatency-64k (Ubuntu package) - update to 6.8.0-1026.29.1
linux-image-6.8.0-1026-nvidia-lowlatency-64k (Ubuntu package) - update to 6.8.0-1026.29.1
linux-image-6.8.0-1026-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1026.29.1
linux-image-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1026.29.1
linux-image-nvidia-6.8 (Ubuntu package) - update to 6.8.0-1026.29~22.04.1
linux-image-nvidia-64k-hwe-22.04 (Ubuntu package) - update to 6.8.0-1026.29~22.04.1
linux-image-nvidia-64k-6.8 (Ubuntu package) - update to 6.8.0-1026.29~22.04.1
linux-image-nvidia-hwe-22.04 (Ubuntu package) - update to 6.8.0-1026.29~22.04.1
linux-image-6.8.0-1027-aws (Ubuntu package) - addressed in versions 6.8.0-1027.29, 6.8.0-1027.29~22.04.1
linux-image-aws (Ubuntu package) - addressed in versions 6.8.0-1027.29, 6.8.0-1027.29~22.04.1, 6.11.0-1009.10
linux-image-aws-lts-24.04 (Ubuntu package) - update to 6.8.0-1027.29
linux-image-azure-lts-24.04 (Ubuntu package) - update to 6.8.0-1027.32
linux-image-azure-fde-lts-24.04 (Ubuntu package) - update to 6.8.0-1027.32
linux-image-6.8.0-1027-azure (Ubuntu package) - addressed in versions 6.8.0-1027.32, 6.8.0-1027.32~22.04.1
linux-image-6.8.0-1027-azure-fde (Ubuntu package) - addressed in versions 6.8.0-1027.32, 6.8.0-1027.32~22.04.1
linux-image-azure-fde (Ubuntu package) - addressed in versions 6.8.0-1027.32~22.04.1, 6.11.0-1009.9
linux-image-azure (Ubuntu package) - addressed in versions 6.8.0-1027.32~22.04.1, 6.11.0-1009.9
linux-image-6.8.0-1028-gcp (Ubuntu package) - addressed in versions 6.8.0-1028.30, 6.8.0-1028.30~22.04.1
linux-image-6.8.0-1028-gcp-64k (Ubuntu package) - addressed in versions 6.8.0-1028.30, 6.8.0-1028.30~22.04.1
linux-image-gcp-64k-lts-24.04 (Ubuntu package) - update to 6.8.0-1028.30
linux-image-gcp-lts-24.04 (Ubuntu package) - update to 6.8.0-1028.30
linux-image-gcp-64k (Ubuntu package) - update to 6.8.0-1028.30~22.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 6.8.0-1028.30~22.04.1, 6.11.0-1009.9
linux-image-6.11.0-18-generic-64k (Ubuntu package) - update to 6.11.0-18.18
linux-image-6.11.0-18-generic (Ubuntu package) - update to 6.11.0-18.18
linux-image-generic-64k-hwe-24.04 (Ubuntu package) - update to 6.11.0-18.18
linux-image-virtual-hwe-24.04 (Ubuntu package) - update to 6.11.0-18.18
linux-image-generic-hwe-24.04 (Ubuntu package) - update to 6.11.0-18.18
linux-image-6.11.0-1005-realtime (Ubuntu package) - update to 6.11.0-1005.5
linux-image-raspi (Ubuntu package) - update to 6.11.0-1008.8
linux-image-6.11.0-1008-raspi (Ubuntu package) - update to 6.11.0-1008.8
linux-image-6.11.0-1009-gcp (Ubuntu package) - update to 6.11.0-1009.9
linux-image-6.11.0-1009-azure (Ubuntu package) - update to 6.11.0-1009.9
linux-image-6.11.0-1009-azure-fde (Ubuntu package) - update to 6.11.0-1009.9
linux-image-6.11.0-1009-aws (Ubuntu package) - update to 6.11.0-1009.10
linux-image-6.11.0-1010-lowlatency (Ubuntu package) - update to 6.11.0-1010.11
linux-image-6.11.0-1010-lowlatency-64k (Ubuntu package) - update to 6.11.0-1010.11
linux-image-6.11.0-1011-oracle-64k (Ubuntu package) - update to 6.11.0-1011.12
linux-image-6.11.0-1011-oracle (Ubuntu package) - update to 6.11.0-1011.12
linux-image-6.11.0-1015-oem (Ubuntu package) - update to 6.11.0-1015.15
linux-image-oem-24.04b (Ubuntu package) - update to 6.11.0-1015.15

External References

Related Security Bulletins