CVE-2024-49936

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58

Description The issue is related to a use-after-free (UAF) vulnerability in the xenvif flush hash() function. This occurs because kfree rcu is called outside the RCU read critical section during the list for each entry rcu iteration, leading to UAF when accessing head->next after the entry becomes free. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider modifying the xenvif flush hash() function to use list for each entry safe instead of list for each entry rcu to prevent the UAF vulnerability.