{"api_version":"1","generated_at":"2026-07-23T14:30:51+00:00","cve":"CVE-2024-35955","urls":{"html":"https://cve.report/CVE-2024-35955","api":"https://cve.report/api/cve/CVE-2024-35955.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-35955","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-35955"},"summary":{"title":"kprobes: Fix possible use-after-free issue on kprobe registration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix possible use-after-free issue on kprobe registration\n\nWhen unloading a module, its state is changing MODULE_STATE_LIVE ->\n MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take\na time. `is_module_text_address()` and `__module_text_address()`\nworks with MODULE_STATE_LIVE and MODULE_STATE_GOING.\nIf we use `is_module_text_address()` and `__module_text_address()`\nseparately, there is a chance that the first one is succeeded but the\nnext one is failed because module->state becomes MODULE_STATE_UNFORMED\nbetween those operations.\n\nIn `check_kprobe_address_safe()`, if the second `__module_text_address()`\nis failed, that is ignored because it expected a kernel_text address.\nBut it may have failed simply because module->state has been changed\nto MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify\nnon-exist module text address (use-after-free).\n\nTo fix this problem, we should not use separated `is_module_text_address()`\nand `__module_text_address()`, but use only `__module_text_address()`\nonce and do `try_module_get(module)` which is only available with\nMODULE_STATE_LIVE.","state":"PUBLISHED","assigner":"Linux","published_at":"2024-05-20 10:15:10","updated_at":"2026-05-12 12:16:43"},"problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","name":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33","name":"https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808","name":"https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26d","name":"https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26d","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2e","name":"https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2e","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8","name":"https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0","name":"https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2f","name":"https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2f","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412","name":"https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","name":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35955","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35955","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8 b5808d40093403334d939e2c3c417144d12a6f33 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6a119c1a584aa7a2c6216458f1f272bf1bc93a93 93eb31e7c3399e326259f2caa17be1e821f5a412 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2a49b025c36ae749cee7ccc4b7e456e02539cdc3 5062d1f4f07facbdade0f402d9a04a788f52e26d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a1edb85e60fdab1e14db63ae8af8db3f0d798fb6 2df2dd27066cdba8041e46a64362325626bdfb2e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 28f6c37a2910f565b4f5960df52b2eccae28c891 62029bc9ff2c17a4e3a2478d83418ec575413808 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 28f6c37a2910f565b4f5960df52b2eccae28c891 d15023fb407337028a654237d8968fefdcf87c2f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 28f6c37a2910f565b4f5960df52b2eccae28c891 36b57c7d2f8b7de224980f1a284432846ad71ca0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 28f6c37a2910f565b4f5960df52b2eccae28c891 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4262b6eb057d86c7829168c541654fe0d48fdac8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 97e813e6a143edf4208e15c72199c495ed80cea5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 16a544f1e013ba0660612f3fe35393b143b19a84 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.0","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.0 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.313 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.275 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.216 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.157 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.87 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.28 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8.7 6.8.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.9 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 1c836bad43f3 b5808d400934 git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 6a119c1a584a 93eb31e7c339 git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 2a49b025c36a 93eb31e7c339 git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected a1edb85e60fd 2df2dd27066c git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 28f6c37a2910 62029bc9ff2c git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 28f6c37a2910 d15023fb4073 git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 28f6c37a2910 36b57c7d2f8b git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 28f6c37a2910 325f3fb551f8 git","platforms":[]},{"source":"ADP","vendor":"linux","product":"linux_kernel","version":"affected 6.0","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM RST2428P","version":"affected V3.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","version":"unaffected * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","version":"affected V3.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","version":"affected * custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"35955","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"affected":[{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"linux_kernel","vendor":"linux","versions":[{"lessThan":"b5808d400934","status":"affected","version":"1c836bad43f3","versionType":"git"},{"lessThan":"93eb31e7c339","status":"affected","version":"6a119c1a584a","versionType":"git"},{"lessThan":"93eb31e7c339","status":"affected","version":"2a49b025c36a","versionType":"git"},{"lessThan":"2df2dd27066c","status":"affected","version":"a1edb85e60fd","versionType":"git"},{"lessThan":"62029bc9ff2c","status":"affected","version":"28f6c37a2910","versionType":"git"},{"lessThan":"d15023fb4073","status":"affected","version":"28f6c37a2910","versionType":"git"},{"lessThan":"36b57c7d2f8b","status":"affected","version":"28f6c37a2910","versionType":"git"},{"lessThan":"325f3fb551f8","status":"affected","version":"28f6c37a2910","versionType":"git"},{"status":"affected","version":"6.0"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2024-35955","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-05-20T17:42:32.103628Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-08-01T13:44:14.513Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-02T03:21:48.971Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26d"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2e"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2f"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0"},{"tags":["x_transferred"],"url":"https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}],"title":"CVE Program Container"},{"affected":[{"defaultStatus":"unknown","product":"RUGGEDCOM RST2428P","vendor":"Siemens","versions":[{"lessThan":"V3.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","vendor":"Siemens","versions":[{"lessThan":"*","status":"unaffected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","vendor":"Siemens","versions":[{"lessThan":"V3.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T11:53:10.672Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/kprobes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5808d40093403334d939e2c3c417144d12a6f33","status":"affected","version":"1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8","versionType":"git"},{"lessThan":"93eb31e7c3399e326259f2caa17be1e821f5a412","status":"affected","version":"6a119c1a584aa7a2c6216458f1f272bf1bc93a93","versionType":"git"},{"lessThan":"5062d1f4f07facbdade0f402d9a04a788f52e26d","status":"affected","version":"2a49b025c36ae749cee7ccc4b7e456e02539cdc3","versionType":"git"},{"lessThan":"2df2dd27066cdba8041e46a64362325626bdfb2e","status":"affected","version":"a1edb85e60fdab1e14db63ae8af8db3f0d798fb6","versionType":"git"},{"lessThan":"62029bc9ff2c17a4e3a2478d83418ec575413808","status":"affected","version":"28f6c37a2910f565b4f5960df52b2eccae28c891","versionType":"git"},{"lessThan":"d15023fb407337028a654237d8968fefdcf87c2f","status":"affected","version":"28f6c37a2910f565b4f5960df52b2eccae28c891","versionType":"git"},{"lessThan":"36b57c7d2f8b7de224980f1a284432846ad71ca0","status":"affected","version":"28f6c37a2910f565b4f5960df52b2eccae28c891","versionType":"git"},{"lessThan":"325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8","status":"affected","version":"28f6c37a2910f565b4f5960df52b2eccae28c891","versionType":"git"},{"status":"affected","version":"4262b6eb057d86c7829168c541654fe0d48fdac8","versionType":"git"},{"status":"affected","version":"97e813e6a143edf4208e15c72199c495ed80cea5","versionType":"git"},{"status":"affected","version":"16a544f1e013ba0660612f3fe35393b143b19a84","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/kprobes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.313","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.275","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.216","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.157","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.87","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.28","versionType":"semver"},{"lessThanOrEqual":"6.8.*","status":"unaffected","version":"6.8.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.9","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.313","versionStartIncluding":"4.19.256","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.275","versionStartIncluding":"5.4.211","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.216","versionStartIncluding":"5.10.137","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.157","versionStartIncluding":"5.15.61","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.87","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.28","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.7","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.291","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix possible use-after-free issue on kprobe registration\n\nWhen unloading a module, its state is changing MODULE_STATE_LIVE ->\n MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take\na time. `is_module_text_address()` and `__module_text_address()`\nworks with MODULE_STATE_LIVE and MODULE_STATE_GOING.\nIf we use `is_module_text_address()` and `__module_text_address()`\nseparately, there is a chance that the first one is succeeded but the\nnext one is failed because module->state becomes MODULE_STATE_UNFORMED\nbetween those operations.\n\nIn `check_kprobe_address_safe()`, if the second `__module_text_address()`\nis failed, that is ignored because it expected a kernel_text address.\nBut it may have failed simply because module->state has been changed\nto MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify\nnon-exist module text address (use-after-free).\n\nTo fix this problem, we should not use separated `is_module_text_address()`\nand `__module_text_address()`, but use only `__module_text_address()`\nonce and do `try_module_get(module)` which is only available with\nMODULE_STATE_LIVE."}],"providerMetadata":{"dateUpdated":"2026-05-11T20:14:25.959Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33"},{"url":"https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412"},{"url":"https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26d"},{"url":"https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2e"},{"url":"https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808"},{"url":"https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2f"},{"url":"https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0"},{"url":"https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8"}],"title":"kprobes: Fix possible use-after-free issue on kprobe registration","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-35955","datePublished":"2024-05-20T09:41:48.607Z","dateReserved":"2024-05-17T13:50:33.136Z","dateUpdated":"2026-05-12T11:53:10.672Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-05-20 10:15:10","lastModifiedDate":"2026-05-12 12:16:43","problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.291","versionEndExcluding":"4.15","matchCriteriaId":"5A5EEFF9-94C9-4B98-B433-9D09A07C3668"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.256","versionEndExcluding":"4.19.313","matchCriteriaId":"5AC59981-14D3-408D-B5A4-D0A17DDB8A23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.211","versionEndExcluding":"5.4.275","matchCriteriaId":"EA3335E7-9267-4C3D-93F8-626223FD0C44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.137","versionEndExcluding":"5.10.216","matchCriteriaId":"F7EFD3C1-FFE1-4E51-9321-E0C1C216D7E7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.61","versionEndExcluding":"5.15.157","matchCriteriaId":"F7CED2BD-9C9A-489D-81FE-5E249A63D90F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.18","versionEndExcluding":"5.19","matchCriteriaId":"B60CAFE2-08C3-461B-B5F8-25BEB0C9853E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.2","versionEndExcluding":"6.1.87","matchCriteriaId":"FC550D0F-01F1-44D5-B09C-D455B0C23990"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.28","matchCriteriaId":"8D6315B0-B3BA-406C-B0DB-51D9A63753F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.8.7","matchCriteriaId":"531BDFB5-EF6A-4707-902E-146368303499"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*","matchCriteriaId":"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*","matchCriteriaId":"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*","matchCriteriaId":"52048DDA-FC5A-4363-95A0-A6357B4D7F8C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"35955","Ordinal":"1","Title":"kprobes: Fix possible use-after-free issue on kprobe registratio","CVE":"CVE-2024-35955","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"35955","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix possible use-after-free issue on kprobe registration\n\nWhen unloading a module, its state is changing MODULE_STATE_LIVE ->\n MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take\na time. `is_module_text_address()` and `__module_text_address()`\nworks with MODULE_STATE_LIVE and MODULE_STATE_GOING.\nIf we use `is_module_text_address()` and `__module_text_address()`\nseparately, there is a chance that the first one is succeeded but the\nnext one is failed because module->state becomes MODULE_STATE_UNFORMED\nbetween those operations.\n\nIn `check_kprobe_address_safe()`, if the second `__module_text_address()`\nis failed, that is ignored because it expected a kernel_text address.\nBut it may have failed simply because module->state has been changed\nto MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify\nnon-exist module text address (use-after-free).\n\nTo fix this problem, we should not use separated `is_module_text_address()`\nand `__module_text_address()`, but use only `__module_text_address()`\nonce and do `try_module_get(module)` which is only available with\nMODULE_STATE_LIVE.","Type":"Description","Title":"kprobes: Fix possible use-after-free issue on kprobe registratio"}]}}}