Security readout for executives and security teams
Plain-English summary
A memory-safety flaw in the Linux kernel’s TIPC networking code can access an object after it has been freed while handling an error. The supplied CVSS rating is 9.8, indicating potentially severe confidentiality, integrity, and availability impact. Practical risk is concentrated on systems where affected TIPC functionality is enabled and reachable.
Executive priority
Treat this as urgent where TIPC is enabled and reachable because the supplied severity is critical and the flaw affects kernel memory safety. Patch those systems promptly. For systems without TIPC exposure, verify configuration and vendor package status before assigning emergency remediation, rather than relying solely on the headline CVSS score.
Technical view
CVE-2024-36886 is a CWE-416 use-after-free in the tipc_buf_append() error path. The supplied KASAN trace places the fault in inbound TIPC processing, including TIPC-over-UDP reception. Linux stable commits address the flaw across supported kernel branches, but the supplied version data is insufficient for reliable package-level determinations.
Likely exposure
Potentially exposed assets are Linux systems running an affected kernel with TIPC enabled, especially where TIPC-over-UDP traffic can reach the host. Kernel version alone may be misleading because distributions backport fixes. Systems without active or reachable TIPC functionality likely have substantially reduced practical exposure, though package status still requires verification.
Exploitation context
The supplied record is not marked as CISA KEV, and the source bundle provides no evidence of active exploitation or a public exploit. The reported proof triggered a KASAN-detected use-after-free. The 9.8 network vector reflects severe theoretical impact, but the sources do not establish reliable exploitation beyond causing the memory-safety condition.
Researcher notes
The failure occurs in tipc_buf_append() cleanup and is observed through kfree_skb_list_reason(), indicating erroneous lifetime handling on an error path. The trace demonstrates inbound UDP delivery into TIPC processing. Sources confirm stable-branch fixes but do not establish exploit primitives, attacker-controlled reachability requirements, or successful code execution.
Mitigation direction
- Install a vendor-supported kernel package that incorporates the applicable upstream stable fix.
- Consult the operating-system vendor advisory for exact fixed package versions and reboot requirements.
- If operationally feasible, disable unused TIPC functionality pending patching.
- Restrict TIPC and TIPC-over-UDP traffic to explicitly trusted peers and networks.
- Prioritize internet-facing, multi-tenant, and high-availability systems where TIPC is enabled.
Validation and detection
- Inventory kernel package versions and compare them with distribution-specific fixed-version guidance.
- Determine whether TIPC is built, loaded, configured, or actively used on each asset.
- Review network configuration for TIPC-over-UDP bearers and reachable trust boundaries.
- Confirm the running kernel contains the relevant stable fix or vendor backport.
- Review kernel logs for TIPC-related crashes or memory-corruption indicators; absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36886 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bdCVE reference, Linux
- https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40CVE reference, Linux
- https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1CVE reference, Linux
- https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684CVE reference, Linux
- https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14CVE reference, Linux
- https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682CVE reference, Linux
- https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90CVE reference, Linux
- https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20241018-0002/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.