CVE-2024-36886
This vulnerability is a use‑after‑free in the Linux kernel’s TIPC networking code. An attacker could trigger a crash or potentially execute arbitrary code by sending crafted packets. The flaw has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.9 and earlier, including Debian 10.0. Any system running a kernel version that contains the vulnerable TIPC code is affected.
Real-world impact
An attacker could crash the system or run arbitrary code by sending specially crafted TIPC packets, potentially leading to denial of service or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely without authentication, with no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the tipc UAF fix.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- May 30, 2024 · May 30, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/080cbb890286cd794f…patch
- git.kernel.org/stable/c/21ea04aad8a0839b4e…patch
- git.kernel.org/stable/c/367766ff9e407f8a68…patch
- git.kernel.org/stable/c/66116556076f0b96bc…patch
- git.kernel.org/stable/c/93bc2d6d16f2c31787…patch
- git.kernel.org/stable/c/a0fbb26f8247e326a3…patch
- git.kernel.org/stable/c/e19ec8ab0e25bc4803…patch
- git.kernel.org/stable/c/ffd4917c1edb3c3ff3…patch
- lists.debian.org/debian-lts-announce/2024/06…third party advisory
- lists.debian.org/debian-lts-announce/2024/06…third party advisory
- security.netapp.com/advisory/ntap-20241018-0002…third party advisory