{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-44998",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-44998"
  ],
  "published": "2024-09-04T19:57:01Z",
  "summary": "atm: idt77252: prevent use after free in dequeue_rx()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: idt77252: prevent use after free in dequeue_rx()\n\nWe can't dereference \"skb\" after calling vcc->push() because the skb\nis released.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.107",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44998"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/628ea82190a678a56d2ec38cda3addf3b3a6248d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/09e086a5f72ea27c758b3f3b419a69000c32adc1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1cece837e387c039225f19028df255df87a97c0d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/24cf390a5426aac9255205e9533cdd7b4235d518"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/379a6a326514a3e2f71b674091dfb0e0e7522b55"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ef23c18ab88e33ce000d06a5c6aad0620f219bfd"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/91b4850e7165a4b7180ef1e227733bcb41ccdf10"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a9a18e8f770c9b0703dab93580d0b02e199a4c79"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - The UAF is triggered purely by an AAL5 PDU received from the remote end of an ATM virtual circuit, processed in the card's interrupt handler before any higher-layer filtering. ATM VCs are switched WAN circuits (DSL/backhaul), and via br2684/pppoatm they carry ordinary internet traffic, so the attacker set extends beyond a single shared segment.\nAC:L - The attacker fully controls both the packet size (choosing the single-skb reassembly branch) and the encapsulation header that forces br2684_push()/pppoatm_push() down their `kfree_skb()` error path, making the use-after-free deterministic on a single packet with no race to win.\nPR:N - No authentication or authorization exists anywhere on this path \u2014 the skb is freed and then re-dereferenced inside the driver's hardirq receive handler, long before any application-level credential check.\nUI:N - The vulnerable code runs automatically on packet reception; no local user must open, mount, or interact with anything for the attacker's frame to be processed.\nS:U - The freed sk_buff and the corrupted buffer-management state are both kernel resources managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a slab object the attacker can groom by keeping concurrent traffic in flight, so the reclaimed sk_buff contents are read back into driver control flow \u2014 per kernel UAF convention this constitutes a high-confidentiality read primitive.\nI:H - A use-after-free on a sprayable slab object allows the attacker to influence the value the driver consumes, which in turn drives subsequent skb allocation, DMA mapping, and free-buffer-queue bookkeeping; UAFs of this class are treated as exploitable for arbitrary write/control-flow hijacking.\nA:H - The stale read occurs in hardirq context and panics KASAN/KFENCE/panic_on_warn kernels; even on stock kernels, repeated remote packets cause the wrong free-buffer queue to be refilled, starving the correct SAR FBQ and permanently stalling the card's receive path."
    }
  }
}