What is the CVSS score of CVE-2024-38612?

CVE-2024-38612 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38612?

A use-after-free vulnerability in the Linux kernel's IPv6 Segment Routing subsystem (CVE-2024-38612, CVSS 7.0) allows local users with low system privileges to trigger kernel memory corruption and…. A patch is available.

How to fix or mitigate CVE-2024-38612?

Within 24 hours, identify all Linux systems in production and non-production environments running the affected kernel versions, focusing on systems with IPv6 Segment Routing enabled and noting the specific kernel versions in use. Within 7 days, apply the patch available per vendor advisory to all identified systems through your standard Linux update process, prioritizing production systems and critical infrastructure. Within 30 days, complete a comprehensive audit of all Linux systems to confirm successful patch deployment and verify no systems remain on vulnerable kernel versions using configuration management or vulnerability scanning tools.

Linux Kernel CVE-2024-38612

HIGH

Use After Free (CWE-416)

2024-06-19 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption

7.0

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector and high complexity confirmed by dual build-config prerequisite; low privileges and high impact appropriate for kernel use-after-free with privilege escalation potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:59 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:52 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

CRITICAL HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

9.8 (CRITICAL) 7.0 (HIGH)

CVE Published

Jun 19, 2024 - 14:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix invalid unregister error path

The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called.

This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() with genl_unregister_family() in this error path.

AnalysisAI

Use-after-free exposure in the Linux kernel's IPv6 Segment Routing (SR) subsystem arises from a defective error path in seg6_init() that omits a required genl_unregister_family() call when CONFIG_IPV6_SEG6_LWTUNNEL is not compiled in and seg6_hmac_init() subsequently fails, leaving a dangling kernel generic netlink family registration. A local attacker with low privileges on a specifically configured kernel build could leverage the resulting CWE-416 memory corruption to trigger kernel instability or potentially escalate privileges to ring-0. No public exploit code has been identified at time of analysis, and EPSS probability stands at a low 0.17%, indicating limited observed exploitation interest.

Technical ContextAI

The affected subsystem is the Linux kernel's IPv6 Segment Routing implementation (net/ipv6/seg6.c), specifically the module initialization function seg6_init(). The bug originates from conditional compilation: when CONFIG_IPV6_SEG6_LWTUNNEL is undefined, the code takes an alternate error-handling branch that skips a call to genl_unregister_family(), meaning the generic netlink family registered earlier in initialization is never cleaned up on failure. This violates kernel resource ownership invariants and introduces a CWE-416 (Use After Free) condition - the freed or partially initialized genl family structure may be dereferenced by later netlink operations. The root cause traces to commit 46738b1317e1 introducing the conditional lwtunnel path, compounded by commit 5559cea2d5aa which replaced unregister_pernet_subsys() with genl_unregister_family() in the error unwind without correctly guarding it under the same CONFIG flag. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, spanning multiple stable branches as evidenced by nine separate stable-tree patch commits.

RemediationAI

The primary fix is to apply the upstream stable kernel patches provided across nine stable-tree commits, the first of which is available at https://git.kernel.org/stable/c/00e6335329f23ac6cf3105931691674e28bc598c; additional stable-branch backports are at the sibling commit URLs listed in the NVD references. Distribution users should update to the patched kernel version provided by their Linux vendor (RHEL, Ubuntu, SUSE, Debian, etc.) once downstream packages incorporating these stable commits are released. For systems where immediate kernel upgrade is not feasible, the most effective compensating control is ensuring IPv6 Segment Routing HMAC support (CONFIG_IPV6_SEG6_HMAC) is also absent from the build, as the dangerous code path is only triggered when seg6_hmac_init() is called and fails - eliminating HMAC support removes the failure trigger. Additionally, restricting local user access via namespace isolation (disabling unprivileged user namespaces with sysctl kernel.unprivileged_userns_clone=0) reduces the pool of potential local exploiters, though it does not eliminate the underlying bug. Patch availability is confirmed by vendor (kernel.org stable tree); exact patched release version per distribution should be verified against the distribution's security advisories.