CVE intelligence and bounded remediation

CVE-2024-46858 — Linux Linux Kernel security vulnerability

High CVSS 7

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do n…

Severity
High
CVSS
7 (3.1)
Published
2024-09-27
CISA KEV
Not currently listed
Ecosystem
linux/kernel
Weaknesses
CWE-416

Affected products

  • linux / linux_kernel
  • linux / linux_kernel / 6.11

Showing 2 representative product identities from 10 source matches. Confirm exact affected versions with the linked vendor and NVD evidence.

Matched remediation archetype

Use-after-free, double free, and expired resource use

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Trace ownership, references, callbacks, asynchronous tasks, and teardown paths around the affected object or resource.
  • Identify reachable inputs and timing or state transitions that can release the object while references remain.
  • Confirm affected builds, allocators, feature flags, architectures, and process privileges.

Remediate safely

  • Apply the maintained ownership or lifetime fix and rebuild all artifacts containing the affected native code.
  • Use explicit ownership, safe reference management, cancellation and join semantics, and idempotent teardown.
  • Add deterministic lifetime tests plus isolated sanitizer and concurrency coverage for shutdown and error paths.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.