CVE-2024-42108
A critical use‑after‑free bug in the Linux kernel’s rswitch driver can cause a crash when processing network packets. The flaw occurs when a packet buffer is freed before its length is read, leading to a kernel panic. It can be triggered by simple network traffic such as ARP or ping.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users running a kernel version that contains the rswitch driver before the patch.
Real-world impact
An attacker could cause a denial of service by sending crafted packets that trigger the crash, disrupting the affected system.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s ability to crash the system without authentication, with no user interaction required, and affecting confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2024-42108.
NVD-referenced vendor advisory
Timeline
- Jul 30, 2024 · Jul 30, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.