CVE-2024-44934 is a use-after-free vulnerability in the Linux kernel's bridge multicast component, specifically affecting the net: bridge: mcast module. This flaw occurs when a port is removed without ensuring all previous garbage collection cycles have completed, leading to a race condition where the port can be freed while its group timers are still active. Rated with a CVSS score of 7.8 (High), this vulnerability has a local attack vector and low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. Currently, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.10, < 5.15.165CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 6.1.105CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.2, < 6.6.46CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.7, < 6.10.5CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
HP ThinPro 8.1 SP7 Security Updates
Jun 3, 2025HP ThinPro 8.1 SP7 Security Updates
Jun 3, 2025CVE-2024-44934
Oct 8, 2024kernel: net: bridge: mcast: wait for previous gc cycles when removing port
Aug 26, 2024net: bridge: mcast: wait for previous gc cycles when removing port
Aug 13, 2024