CVE-2024-36971

CVE-2024-36971 is a Use-After-Free (UAF) vulnerability in the Linux kernel's networking subsystem, specifically within the __dst_negative_advice() function, affecting Debian and other Linux kernel distributions. This flaw stems from improper RCU (Read-Copy-Update) rules when clearing sk->dst_cache, leading to a race condition. It carries a CVSSv3.1 score of 7.8 (HIGH), indicating a local attack vector with low complexity, potentially resulting in high impact to confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog, and has garnered significant community discussion and media coverage, despite a lack of public exploit code.