{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-46785 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-46785 is a medium-severity vulnerability in Linux kernel, published on 18 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-46785 and fix it if it is affected.\n\nWhat it is: CVE-2024-46785 is a medium-severity vulnerability in Linux kernel, published on 18 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-46785 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-46785/ (Markdown: https://insights.sbomify.com/CVE-2024-46785/index.md)","id":"CVE-2024-46785","markdown":"https://insights.sbomify.com/CVE-2024-46785/index.md","name":"CVE-2024-46785","record":{"aliases":["BELL-CVE-2024-46785","DEBIAN-CVE-2024-46785","GHSA-x443-5gjr-4gr5","UBUNTU-CVE-2024-46785"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel eventfs subsystem causes a null pointer dereference, leading to a system crash when accessing tracefs concurrently.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use list_del_rcu() for SRCU protected list variable\n\nChi Zhiling reported:\n\n  We found a null pointer accessing in tracefs[1], the reason is that the\n  variable 'ei_child' is set to LIST_POISON1, that means the list was\n  removed in eventfs_remove_rec. so when access the ei_child-\u003eis_freed, the\n  panic triggered.\n\n  by the way, the following script can reproduce this panic\n\n  loop1 (){\n      while true\n      do\n          echo \"p:kp submit_bio\" \u003e /sys/kernel/debug/tracing/kprobe_events\n          echo \"\" \u003e /sys/kernel/debug/tracing/kprobe_events\n      done\n  }\n  loop2 (){\n      while true\n      do\n          tree /sys/kernel/debug/tracing/events/kprobes/\n      done\n  }\n  loop1 \u0026\n  loop2\n\n  [1]:\n  [ 1147.959632][T17331] Unable to handle kernel paging request at virtual address dead000000000150\n  [ 1147.968239][T17331] Mem abort info:\n  [ 1147.971739][T17331]   ESR = 0x0000000096000004\n  [ 1147.976172][T17331]   EC = 0x25: DABT (current EL), IL = 32 bits\n  [ 1147.982171][T17331]   SET = 0, FnV = 0\n  [ 1147.985906][T17331]   EA = 0, S1PTW = 0\n  [ 1147.989734][T17331]   FSC = 0x04: level 0 translation fault\n  [ 1147.995292][T17331] Data abort info:\n  [ 1147.998858][T17331]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n  [ 1148.005023][T17331]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  [ 1148.010759][T17331]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [ 1148.016752][T17331] [dead000000000150] address between user and kernel address ranges\n  [ 1148.024571][T17331] Internal error: Oops: 0000000096000004 [#1] SMP\n  [ 1148.030825][T17331] Modules linked in: team_mode_loadbalance team nlmon act_gact cls_flower sch_ingress bonding tls macvlan dummy ib_core bridge stp llc veth amdgpu amdxcp mfd_core gpu_sched drm_exec drm_buddy radeon crct10dif_ce video drm_suballoc_helper ghash_ce drm_ttm_helper sha2_ce ttm sha256_arm64 i2c_algo_bit sha1_ce sbsa_gwdt cp210x drm_display_helper cec sr_mod cdrom drm_kms_helper binfmt_misc sg loop fuse drm dm_mod nfnetlink ip_tables autofs4 [last unloaded: tls]\n  [ 1148.072808][T17331] CPU: 3 PID: 17331 Comm: ls Tainted: G        W         ------- ----  6.6.43 #2\n  [ 1148.081751][T17331] Source Version: 21b3b386e948bedd29369af66f3e98ab01b1c650\n  [ 1148.088783][T17331] Hardware name: Greatwall GW-001M1A-FTF/GW-001M1A-FTF, BIOS KunLun BIOS V4.0 07/16/2020\n  [ 1148.098419][T17331] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [ 1148.106060][T17331] pc : eventfs_iterate+0x2c0/0x398\n  [ 1148.111017][T17331] lr : eventfs_iterate+0x2fc/0x398\n  [ 1148.115969][T17331] sp : ffff80008d56bbd0\n  [ 1148.119964][T17331] x29: ffff80008d56bbf0 x28: ffff001ff5be2600 x27: 0000000000000000\n  [ 1148.127781][T17331] x26: ffff001ff52ca4e0 x25: 0000000000009977 x24: dead000000000100\n  [ 1148.135598][T17331] x23: 0000000000000000 x22: 000000000000000b x21: ffff800082645f10\n  [ 1148.143415][T17331] x20: ffff001fddf87c70 x19: ffff80008d56bc90 x18: 0000000000000000\n  [ 1148.151231][T17331] x17: 0000000000000000 x16: 0000000000000000 x15: ffff001ff52ca4e0\n  [ 1148.159048][T17331] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [ 1148.166864][T17331] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000804391d0\n  [ 1148.174680][T17331] x8 : 0000000180000000 x7 : 0000000000000018 x6 : 0000aaab04b92862\n  [ 1148.182498][T17331] x5 : 0000aaab04b92862 x4 : 0000000080000000 x3 : 0000000000000068\n  [ 1148.190314][T17331] x2 : 000000000000000f x1 : 0000000000007ea8 x0 : 0000000000000001\n  [ 1148.198131][T17331] Call trace:\n  [ 1148.201259][T17331]  eventfs_iterate+0x2c0/0x398\n  [ 1148.205864][T17331]  iterate_dir+0x98/0x188\n  [ 1148.210036][T17331]  __arm64_sys_getdents64+0x78/0x160\n  [ 1148.215161][T17331]  invoke_syscall+0x78/0x108\n  [ 1148.219593][T17331]  el0_svc_common.constprop.0+0x48/0xf0\n  [ 1148.224977][T17331]  do_el0_svc+0x24/0x38\n  [ 1148.228974][T17331]  el0_svc+0x40/0x168\n  [ 1148.232798][T17\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"eventfs: Use list_del_rcu() for SRCU protected list variable","id":"CVE-2024-46785","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF","id":"CVE-2024-46786"},"packages":[],"prev":{"headline":"net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup","id":"CVE-2024-46784"},"products":["Linux"],"published":"2024-09-18","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-23","vendors":["Linux"]},"summary":"A race condition in the Linux kernel eventfs subsystem causes a null pointer dereference, leading to a system crash when accessing tracefs concurrently.","url":"https://insights.sbomify.com/CVE-2024-46785/"}