01 Record

CVE-2024-39503

netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.22% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 12.8% of scored records. A rank, not a probability.

NVD base score

7.0 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-07-12 12:20Z2 YR AGO

Last updated

2026-08-05 11:33Z1 MO AGO

Reserved

2024-06-25

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Class
CWE-416Use After FreeVariant

Data version

5.2

Document digest

e76cf7c6d5bc854babd907764cc26426af12fcaede8e4e0624d2b2a483fa11e1

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxc7f2733e5011bfd136f1ca93497394d43aa76225 to < c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3, a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 to < 93b53c202b51a69e42ca57f5a183f7e008e19f83, c2dc077d8f722a1c73a24e674f925602ee5ece49 to < 0f1bb77c6d837c9513943bc7c08f04c5cc5c6568, 653bc5e6d9995d7d5f497c665b321875a626161c to < 390b353d1a1da3e9c6c0fd14fe650d69063c95d6, b93a6756a01f4fd2f329a39216f9824c56a66397 to < 2ba35b37f780c6410bb4bba9c3072596d8576702, 97f7cf1cd80eeed3b7c808b7c12463295c751001 to < 90ae20d47de602198eb69e6cd7a3db3420abfc08, 97f7cf1cd80eeed3b7c808b7c12463295c751001 to < 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10, 970709a67696b100a57b33af1a3d75fc34b747eb, 5.4.269 to < 5.4.279, 5.10.210 to < 5.10.221, 5.15.149 to < 5.15.162, 6.1.79 to < 6.1.95, 6.6.18 to < 6.6.35, 6.7.6 to < 6.8, 6.8—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3
git.kernel.orghttps://git.kernel.org/stable/c/93b53c202b51a69e42ca57f5a183f7e008e19f83
git.kernel.orghttps://git.kernel.org/stable/c/0f1bb77c6d837c9513943bc7c08f04c5cc5c6568
git.kernel.orghttps://git.kernel.org/stable/c/390b353d1a1da3e9c6c0fd14fe650d69063c95d6
git.kernel.orghttps://git.kernel.org/stable/c/2ba35b37f780c6410bb4bba9c3072596d8576702
git.kernel.orghttps://git.kernel.org/stable/c/90ae20d47de602198eb69e6cd7a3db3420abfc08
git.kernel.orghttps://git.kernel.org/stable/c/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-613116.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-355557.html

01 Record index

CVE-2024-39503

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2024-39503

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References