{
"schemaVersion": 1,
"attribution": [
{
"source": "CISA Known Exploited Vulnerabilities",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"licence": "US government work"
},
{
"source": "GitHub Advisory Database",
"url": "https://github.com/advisories",
"licence": "CC BY 4.0"
},
{
"source": "Have I Been Pwned",
"url": "https://haveibeenpwned.com/",
"licence": "CC BY 4.0"
},
{
"source": "CVE Program (CVE records)",
"url": "https://www.cve.org/Legal/TermsOfUse",
"licence": "CVE Terms of Use",
"notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
"terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
},
{
"source": "FIRST EPSS",
"url": "https://www.first.org/epss/",
"licence": "free to use; FIRST requests attribution"
}
],
"record": {
"id": "CVE-2024-41040",
"sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-41040",
"idYear": 2024,
"status": "PUBLISHED",
"publishedAt": "2024-07-29T14:31:53.853Z",
"updatedAt": "2026-08-05T11:34:54.957Z",
"importedAt": "2026-10-24T01:57:16.009Z",
"snapshot": {
"id": "cve_2026-10-24_midnight_baseline",
"at": "2026-10-24T00:00:00.000Z",
"source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
},
"facts": {
"title": "net/sched: Fix UAF when resolving a clash",
"summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix UAF when resolving a clash\n\nKASAN reports the following UAF:\n\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\n\n Call Trace:\n \n dump_stack_lvl+0x48/0x70\n print_address_description.constprop.0+0x33/0x3d0\n print_report+0xc0/0x2b0\n kasan_report+0xd0/0x120\n __asan_load1+0x6c/0x80\n tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n tcf_ct_act+0x886/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n __irq_exit_rcu+0x82/0xc0\n irq_exit_rcu+0xe/0x20\n common_interrupt+0xa1/0xb0\n \n \n asm_common_interrupt+0x27/0x40\n\n Allocated by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_alloc_info+0x1e/0x40\n __kasan_krealloc+0x133/0x190\n krealloc+0xaa/0x130\n nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n tcf_ct_act+0x1095/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\n Freed by task 6469:\n kasan_save_stack+0x38/0x70\n kasan_set_track+0x25/0x40\n kasan_save_free_info+0x2b/0x60\n ____kasan_slab_free+0x180/0x1f0\n __kasan_slab_free+0x12/0x30\n slab_free_freelist_hook+0xd2/0x1a0\n __kmem_cache_free+0x1a2/0x2f0\n kfree+0x78/0x120\n nf_conntrack_free+0x74/0x130 [nf_conntrack]\n nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n tcf_ct_act+0x12ad/0x1350 [act_ct]\n tcf_action_exec+0xf8/0x1f0\n fl_classify+0x355/0x360 [cls_flower]\n __tcf_classify+0x1fd/0x330\n tcf_classify+0x21c/0x3c0\n sch_handle_ingress.constprop.0+0x2c5/0x500\n __netif_receive_skb_core.constprop.0+0xb25/0x1510\n __netif_receive_skb_list_core+0x220/0x4c0\n netif_receive_skb_list_internal+0x446/0x620\n napi_complete_done+0x157/0x3d0\n gro_cell_poll+0xcf/0x100\n __napi_poll+0x65/0x310\n net_rx_action+0x30c/0x5c0\n __do_softirq+0x14f/0x491\n\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack.",
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"versions": [
{
"version": "f07c548314776231f0d47d73ec6caa5b17e876e8",
"status": "affected",
"versionType": "git",
"lessThan": "b81a523d54ea689414f67c9fb81a5b917a41ed55"
},
{
"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33",
"status": "affected",
"versionType": "git",
"lessThan": "2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"
},
{
"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33",
"status": "affected",
"versionType": "git",
"lessThan": "4e71b10a100861fb27d9c5755dfd68f615629fae"
},
{
"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33",
"status": "affected",
"versionType": "git",
"lessThan": "799a34901b634008db4a7ece3900e2b971d4c932"
},
{
"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33",
"status": "affected",
"versionType": "git",
"lessThan": "ef472cc6693b16b202a916482df72f35d94bd69e"
},
{
"version": "0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33",
"status": "affected",
"versionType": "git",
"lessThan": "26488172b0292bed837b95a006a3f3431d1898c3"
},
{
"version": "30822781c89943b6a3ed122324ceb37cea7042a3",
"status": "affected",
"versionType": "git"
},
{
"version": "5.10.43",
"status": "affected",
"versionType": "semver",
"lessThan": "5.10.222"
},
{
"version": "5.12.10",
"status": "affected",
"versionType": "semver",
"lessThan": "5.13"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"versions": [
{
"version": "5.13",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "5.13"
},
{
"version": "5.10.222",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"version": "5.15.163",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.100",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.41",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.9.10",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.9.*"
},
{
"version": "6.10",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
]
}
}
}