CVE-2024-43892 (GCVE-0-2024-43892)
Vulnerability from cvelistv5
Published
2024-08-26 10:10
Modified
2026-08-05 11:37
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to maintain the memcg ID space. The IDR depends on external synchronization mechanisms for modifications. For the mem_cgroup_idr, the idr_alloc() and idr_replace() happen within css callback and thus are protected through cgroup_mutex from concurrent modifications. However idr_remove() for mem_cgroup_idr was not protected against concurrency and can be run concurrently for different memcgs when they hit their refcnt to zero. Fix that. We have been seeing list_lru based kernel crashes at a low frequency in our fleet for a long time. These crashes were in different part of list_lru code including list_lru_add(), list_lru_del() and reparenting code. Upon further inspection, it looked like for a given object (dentry and inode), the super_block's list_lru didn't have list_lru_one for the memcg of that object. The initial suspicions were either the object is not allocated through kmem_cache_alloc_lru() or somehow memcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but returned success. No evidence were found for these cases. Looking more deeply, we started seeing situations where valid memcg's id is not present in mem_cgroup_idr and in some cases multiple valid memcgs have same id and mem_cgroup_idr is pointing to one of them. So, the most reasonable explanation is that these situations can happen due to race between multiple idr_remove() calls or race between idr_alloc()/idr_replace() and idr_remove(). These races are causing multiple memcgs to acquire the same ID and then offlining of one of them would cleanup list_lrus on the system for all of them. Later access from other memcgs to the list_lru cause crashes due to missing list_lru_one.
References
Impacted products
Vendor Product Version
Linux Linux Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 73f576c04b9410ed19660f74f97521bee6e1c546
Version: 8627c7750a66a46d56d3564e1e881aa53764497c
Version: db70cd18d3da727a3a59694de428a9e41c620de7
Version: 4.4.18   ≤
Version: 4.6.6   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43892",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:29:18.942187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:57.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:06:51.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "912736a0435ef40e6a4ae78197ccb5553cb80b05",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "e6cc9ff2ac0b5df9f25eb790934c3104f6710278",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "37a060b64ae83b76600d187d76591ce488ab836b",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "51c0b1bb7541f8893ec1accba59eb04361a70946",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "9972605a238339b85bd16b084eed5f18414d22db",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8627c7750a66a46d56d3564e1e881aa53764497c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db70cd18d3da727a3a59694de428a9e41c620de7",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.18",
              "versionType": "semver"
            },
            {
              "lessThan": "4.7",
              "status": "affected",
              "version": "4.6.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: protect concurrent access to mem_cgroup_idr\n\nCommit 73f576c04b94 (\"mm: memcontrol: fix cgroup creation failure after\nmany small jobs\") decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\n\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block\u0027s list_lru didn\u0027t have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\n\nLooking more deeply, we started seeing situations where valid memcg\u0027s id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven through local syscalls \u2014 cgroupfs mkdir/rmdir to force idr_alloc()/idr_replace(), plus memory allocation and swap-entry frees (munmap/exit/madvise) to force the unlocked idr_remove(). No network vector reaches mem_cgroup_idr.\nAC:L - The attacker controls both sides of the race and can repeat it arbitrarily: fan out swap-entry frees for many rmdir\u0027d, swap-pinned memcgs across all CPUs while concurrently creating cgroups, so both racers are attacker-scheduled rather than depending on incidental system state.\nPR:L - Only an unprivileged local account is needed \u2014 cgroup creation/destruction is available via systemd-delegated user@$UID.service subtrees or unprivileged user namespaces (cgroup2 has FS_USERNS_MOUNT), and the swap-free side requires no privilege at all.\nUI:N - The attacker\u0027s own processes create the cgroups, generate the swap pressure, and free the swap entries; no victim action is involved.\nS:U - The corrupted IDR, radix-tree nodes, and list_lru structures all live in the kernel\u0027s own security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - Unsynchronized radix-tree mutation yields double-freed/reused radix_tree_node objects and stale IDR entries, so mem_cgroup_from_id() can hand out a freed or foreign struct mem_cgroup \u2014 a use-after-free read primitive, plus cross-cgroup leakage of workingset/swap accounting state.\nI:H - The race produces a double free and write-after-free on slab objects, and duplicate IDs cause a live memcg\u0027s list_lru_memcg to be freed while dentry/inode entries remain linked, giving list_add/list_del writes through freed memory \u2014 a heap-corruption write primitive suitable for privilege escalation.\nA:H - The commit documents recurring production kernel crashes in list_lru_add(), list_lru_del(), and the reparenting code; list_lru_from_memcg_idx() returning NULL is dereferenced unchecked while holding nlru-\u003elock, causing an oops that can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:02.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278"
        },
        {
          "url": "https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb04361a70946"
        },
        {
          "url": "https://git.kernel.org/stable/c/9972605a238339b85bd16b084eed5f18414d22db"
        }
      ],
      "title": "memcg: protect concurrent access to mem_cgroup_idr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43892",
    "datePublished": "2024-08-26T10:10:46.612Z",
    "dateReserved": "2024-08-17T09:11:59.290Z",
    "dateUpdated": "2026-08-05T11:37:02.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:06:51.189Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43892\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:29:18.942187Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.492Z\"}}], \"cna\": {\"title\": \"memcg: protect concurrent access to mem_cgroup_idr\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"912736a0435ef40e6a4ae78197ccb5553cb80b05\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"e6cc9ff2ac0b5df9f25eb790934c3104f6710278\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"37a060b64ae83b76600d187d76591ce488ab836b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"51c0b1bb7541f8893ec1accba59eb04361a70946\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"9972605a238339b85bd16b084eed5f18414d22db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8627c7750a66a46d56d3564e1e881aa53764497c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"db70cd18d3da727a3a59694de428a9e41c620de7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.18\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.6.6\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/memcontrol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/memcontrol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05\"}, {\"url\": \"https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278\"}, {\"url\": \"https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb\"}, {\"url\": \"https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b\"}, {\"url\": \"https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb04361a70946\"}, {\"url\": \"https://git.kernel.org/stable/c/9972605a238339b85bd16b084eed5f18414d22db\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmemcg: protect concurrent access to mem_cgroup_idr\\n\\nCommit 73f576c04b94 (\\\"mm: memcontrol: fix cgroup creation failure after\\nmany small jobs\\\") decoupled the memcg IDs from the CSS ID space to fix the\\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\\nspace.  The IDR depends on external synchronization mechanisms for\\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\\nhappen within css callback and thus are protected through cgroup_mutex\\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\\nwas not protected against concurrency and can be run concurrently for\\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\\n\\nWe have been seeing list_lru based kernel crashes at a low frequency in\\nour fleet for a long time.  These crashes were in different part of\\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\\ncode.  Upon further inspection, it looked like for a given object (dentry\\nand inode), the super_block\u0027s list_lru didn\u0027t have list_lru_one for the\\nmemcg of that object.  The initial suspicions were either the object is\\nnot allocated through kmem_cache_alloc_lru() or somehow\\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\\nreturned success.  No evidence were found for these cases.\\n\\nLooking more deeply, we started seeing situations where valid memcg\u0027s id\\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\\nreasonable explanation is that these situations can happen due to race\\nbetween multiple idr_remove() calls or race between\\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\\nmultiple memcgs to acquire the same ID and then offlining of one of them\\nwould cleanup list_lrus on the system for all of them.  Later access from\\nother memcgs to the list_lru cause crashes due to missing list_lru_one.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.226\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.167\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:10.333Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43892\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:10.333Z\", \"dateReserved\": \"2024-08-17T09:11:59.290Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:10:46.612Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.