VYPR
← All advisories
High severity7.8NVD Advisory· Published May 14, 2024· Updated May 12, 2026

CVE-2024-27395

CVE-2024-27395

Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: Fix Use-After-Free in ovs_ct_exit

Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.

To prevent this, it should be changed to hlist_for_each_entry_safe.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Linux kernel's Open vSwitch conntrack limit exit due to improper RCU traversal, allowing local privilege escalation.

Vulnerability

CVE-2024-27395 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) conntrack limit feature. The root cause lies in the ovs_ct_exit function, which traverses a hash list using hlist_for_each_entry_rcu and calls kfree_rcu on each entry. Because kfree_rcu is not executed within an RCU read-side critical section, the RCU grace period can elapse during the traversal, freeing a key that is still being accessed, leading to a use-after-free condition [1].

Exploitation

Exploitation requires local access to the system. The vulnerability is present in the OVS module, commonly used in virtualized environments. An attacker with local user privileges could trigger the conntrack limit cleanup path—for example, by unloading the OVS module or manipulating netfilter rules—to cause the use-after-free. No special authentication beyond local access is needed.

Impact

Successful exploitation could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation or a denial of service (system crash). The CVSS v3 base score of 7.8 (High) reflects the significant impact on confidentiality, integrity, and availability.

Mitigation

The fix was applied in the Linux kernel stable tree via commits [3][4], which replace the RCU traversal with hlist_for_each_entry_safe to prevent the race condition. Users should update to a patched kernel version. Siemens has listed this CVE in their advisory [1] for affected products such as the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, recommending appropriate updates.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

93

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.