{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2024-36886 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-36886 is a critical use after free vulnerability in Debian Debian Linux, published on 30 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-36886 and fix it if it is affected.\n\nWhat it is: CVE-2024-36886 is a critical use after free vulnerability in Debian Debian Linux, published on 30 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-36886 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-36886/ (Markdown: https://insights.sbomify.com/CVE-2024-36886/index.md)","id":"CVE-2024-36886","markdown":"https://insights.sbomify.com/CVE-2024-36886/index.md","name":"CVE-2024-36886","record":{"aliases":["BELL-CVE-2024-36886","DEBIAN-CVE-2024-36886","RHSA-2024:4547","RHSA-2024:4548","RHSA-2024:4713","UBUNTU-CVE-2024-36886"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel's TIPC module allows attackers to cause a denial of service or potentially execute code via crafted network packets.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in error path\n\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\n\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\n\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---","ecosystems":["Red Hat:enterprise_linux:9::baseos","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_eus:9.2::baseos"],"exploits":{"exploitdb":0,"first_seen":"2025-09-01","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-09-01T15:21:42Z","kind":"github_poc","ref":"https://github.com/abubakar-shahid/CVE-2024-36886","stars":1,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"tipc: fix UAF in error path","id":"CVE-2024-36886","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"use_after_free","year":"2024"},"n_packages":15,"n_references":8,"next":{"headline":"e1000e: change usleep_range to udelay in PHY mdic access","id":"CVE-2024-36887"},"packages":[{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["0:1-1.el9_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-427_13_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-427_13_1","source":"RHSA-2024:4713"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["0:1-1.el9_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-427_13_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-427_13_1-debuginfo","source":"RHSA-2024:4713"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["0:1-1.el9_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-427_13_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-427_13_1-debugsource","source":"RHSA-2024:4713"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1-debuginfo","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1-debugsource","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1-debuginfo","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1-debugsource","source":"RHSA-2024:4547"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_48_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_48_1","source":"RHSA-2024:4548"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_48_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_48_1-debuginfo","source":"RHSA-2024:4548"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-4.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_48_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_48_1-debugsource","source":"RHSA-2024:4548"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-3.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1","source":"RHSA-2024:4548"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-3.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1-debuginfo","source":"RHSA-2024:4548"},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","fixed":["0:1-3.el9_2"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-284_52_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_52_1-debugsource","source":"RHSA-2024:4548"}],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2024-36885"},"products":["Linux"],"published":"2024-05-30","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's TIPC module allows attackers to cause a denial of service or potentially execute code via crafted network packets.","url":"https://insights.sbomify.com/CVE-2024-36886/"}