High 8.8Published Oct 21, 2024

CVE-2024-49982aoe: fix the potential use-after-free problem in more places

Updated under an hour ago (Oct 28, 2026, 4:40 PM ET)

Does this affect you?

It affects Linux and 7 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ad80c34944d7175fa1f5c7a55066020002921a99 before 12f7b89dd72b25da4eeaa22097877963cad6418e; from 1a54aa506b3b2f31496731039e49778f54eee881 before a786265aecf39015418e4f930cc1c14603a01490; from faf0b4c5e00bb680e8e43ac936df24d3f48c8e65 before f63461af2c1a86af4217910e47a5c46e3372e645; 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4 builds before 07b418d50ccbbca7e5d87a3a0d41d436cefebf79; from 74ca3ef68d2f449bc848c0a814cefc487bf755fa before bc2cbf7525ac288e07d465f5a1d8cb8fb9599254; from eb48680b0255a9e8a9bdc93d6a55b11c31262e62 before acc5103a0a8c200a52af7d732c36a8477436a3d3; from f98364e926626c678fb4b9004b75cacf92ff0662 before 89d9a69ae0c667e4d9d028028e2dcc837bae626f; from f98364e926626c678fb4b9004b75cacf92ff0662 before 8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58; and 11 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.2	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.10.214 before 5.10.227; from 5.15.153 before 5.15.168; from 6.1.83 before 6.1.113; from 6.6.23 before 6.6.55; from 6.7.11 before 6.8.2; from 6.9 before 6.10.14; from 6.11 before 6.11.3; 4.19.311; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e
https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490
https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645	patch
https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79	patch
https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254	patch
https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3	patch
https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f	patch
https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58	patch
https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3	patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.