---
id: CVE-2024-53141
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: ipset: add missing range check in bitmap_ip_uadt

  When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
  the values of ip and ip_to are sli…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: ipset: add missing range check in bitmap_ip_uadt

  When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
  the values of ip and ip_to are sli…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.39, < 4.19.325'
  - 'linux_kernel >= 4.20, < 6.6.64'
  - 'linux_kernel >= 6.7, < 6.11.11'
  - 'linux_kernel >= 6.12, < 6.12.2'
patched:
  - linux_kernel 6.12.2
published: '2024-12-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:00.690'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53141'
references:
  - url: 'https://git.kernel.org/stable/c/15794835378ed56fb9bacc6a5dd3b9f33520604e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2e151b8ca31607d14fddc4ad0f14da0893e1a7c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/35f56c554eb1b56b77b3cf197a6b00922d49033d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3c20b5948f119ae61ee35ad8584d666020c91581'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/591efa494a1cf649f50a35def649c43ae984cd03'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78b0f2028f1043227a8eb0c41944027fc6a04596'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7ffef5e5d5eeecd9687204a5ec2d863752aafb7e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/856023ef032d824309abd5c747241dffa33aae8c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e67471437ae9083fa73fa67eee1573fec1b7c8cf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00396
epssPercentile: 0.33643
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:40:52.037310Z'
ingestedAt: '2026-10-15T22:48:25.442Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: add missing range check in bitmap_ip_uadt

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
the values of ip and ip_to are slightly swapped. Therefore, the range check
for ip should be done later, but this part is missing and it seems that the
vulnerability occurs.

So we should add missing range checks and remove unnecessary range checks.

## Affected

- `linux_kernel >= 2.6.39, < 4.19.325`
- `linux_kernel >= 4.20, < 6.6.64`
- `linux_kernel >= 6.7, < 6.11.11`
- `linux_kernel >= 6.12, < 6.12.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.12.2`