---
id: CVE-2024-49982
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  aoe: fix the potential use-after-free problem in more places

  For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential
  use-after-free problem in aoecmd_cfg_pkts"…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  aoe: fix the potential use-after-free problem in more places

  For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential
  use-after-free problem in aoecmd_cfg_pkts"…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.10.214, < 5.10.227'
  - 'linux_kernel >= 5.15.153, < 5.15.168'
  - 'linux_kernel >= 6.1.83, < 6.1.113'
  - 'linux_kernel >= 6.6.23, < 6.6.55'
  - 'linux_kernel >= 6.7.11, < 6.8.2'
  - 'linux_kernel >= 6.9, < 6.10.14'
  - 'linux_kernel >= 6.11, < 6.11.3'
  - linux_kernel = 4.19.311
  - linux_kernel = 5.4.273
  - linux_kernel = 6.12
patched:
  - linux_kernel 6.11.3
published: '2024-10-21'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:19:03.173'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-49982'
references:
  - url: 'https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00381
epssPercentile: 0.31923
ingestedAt: '2026-10-15T03:30:12.757Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-22T13:32:22.974285Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

aoe: fix the potential use-after-free problem in more places

For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential
use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put()
instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs
into use-after-free.

Then Nicolai Stange found more places in aoe have potential use-after-free
problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()
and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push
packet to tx queue. So they should also use dev_hold() to increase the
refcnt of skb->dev.

On the other hand, moving dev_put() to tx() causes that the refcnt of
skb->dev be reduced to a negative value, because corresponding
dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),
probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.

## Affected

- `linux_kernel >= 5.10.214, < 5.10.227`
- `linux_kernel >= 5.15.153, < 5.15.168`
- `linux_kernel >= 6.1.83, < 6.1.113`
- `linux_kernel >= 6.6.23, < 6.6.55`
- `linux_kernel >= 6.7.11, < 6.8.2`
- `linux_kernel >= 6.9, < 6.10.14`
- `linux_kernel >= 6.11, < 6.11.3`
- `linux_kernel = 4.19.311`
- `linux_kernel = 5.4.273`
- `linux_kernel = 6.12`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.3`