Answer in brief
CVE-2024-49936 records a Unknown severity vulnerability in net/xen-netback: prevent UAF in xenvif_flush_hash(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-49936 records a Unknown severity vulnerability in net/xen-netback: prevent UAF in xenvif_flush_hash(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <3c4423b0c4b98213b3438e15061e1d08220e6982 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <a0465723b8581cad27164c9073fd780904cd22d4 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <efcff6ce7467f01f0753609f420333f3f2ceceda || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <143edf098b80669d05245b2f2367dd156a83a2c5 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <d408889d4b54f5501e4becc4dbbb9065143fbf4e || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <54d8639af5568fc41c0e274fc3ec9cf86c59fcbb || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 | 3c4423b0c4b98213b3438e15061e1d08220e6982, a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c, a0465723b8581cad27164c9073fd780904cd22d4, efcff6ce7467f01f0753609f420333f3f2ceceda, 143edf098b80669d05245b2f2367dd156a83a2c5, d408889d4b54f5501e4becc4dbbb9065143fbf4e, 54d8639af5568fc41c0e274fc3ec9cf86c59fcbb, 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Oct 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <3c4423b0c4b98213b3438e15061e1d08220e6982 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <a0465723b8581cad27164c9073fd780904cd22d4 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <efcff6ce7467f01f0753609f420333f3f2ceceda || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <143edf098b80669d05245b2f2367dd156a83a2c5 || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <d408889d4b54f5501e4becc4dbbb9065143fbf4e || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <54d8639af5568fc41c0e274fc3ec9cf86c59fcbb || >=40d8abdee806d496a60ee607a6d01b1cd7fabaf0 <0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 | 3c4423b0c4b98213b3438e15061e1d08220e6982, a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c, a0465723b8581cad27164c9073fd780904cd22d4, efcff6ce7467f01f0753609f420333f3f2ceceda, 143edf098b80669d05245b2f2367dd156a83a2c5, d408889d4b54f5501e4becc4dbbb9065143fbf4e, 54d8639af5568fc41c0e274fc3ec9cf86c59fcbb, 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Oct 21, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe.
Quoted source text, attributed separately from HOL analysis.