CVE-2024-35865: linux Use After Free
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2024-35865DEBIAN-CVE-2024-35865
Published 19-05-2024Last modified 05-08-2026
Vulnerability summary
CVE-2024-35865 is a critical (CVSS 9.8) Use After Free vulnerability in linux. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.63%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 29 · Related 28RHSA-2024:9315SUSE-SU-2024:2008-1SUSE-SU-2024:2019-1SUSE-SU-2024:2135-1SUSE-SU-2024:2190-1SUSE-SU-2024:2203-1SUSE-SU-2024:2360-1SUSE-SU-2024:2381-1SUSE-SU-2024:2561-1SUSE-SU-2024:2973-1SUSE-SU-2025:20008-1SUSE-SU-2025:20028-1USN-6893-1USN-6893-2USN-6893-3USN-6918-1USN-8575-1USN-8575-2USN-8575-3USN-8576-1USN-8576-2USN-8597-1USN-8610-1USN-8620-1USN-8620-2USN-8620-3USN-8620-4USN-8668-1USN-8668-2
Timeline
- 19-05-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 18-09-2026
18-09-202618-10-2026
EPSS score0.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu123 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-38.38
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1011.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 7f48558e6489d032b1584b0cc9ac4bb11072c034, < a710ef9e974f18232d2b9b19c90eda1a1167b2d4 | ≥ 7f48558e6489d032b1584b0cc9ac4bb11072c034, < 84488466b7a69570bdbf76dd9576847ab97d54e7 | ≥ 7f48558e6489d032b1584b0cc9ac4bb11072c034, < 21fed37d2bdcde33453faf61d3d4d96c355f04bd | ≥ 7f48558e6489d032b1584b0cc9ac4bb11072c034, < 3dba0e5276f131e36d6d8043191d856f49238628 | ≥ 7f48558e6489d032b1584b0cc9ac4bb11072c034, < 22863485a4626ec6ecf297f4cc0aef709bc862e4 | a67172a013953664b1dad03c648200c70b90506c | ≥ 3.12.48, < 3.13 | 3.13
- linux_kernel< 6.1.85 | ≥ 6.2, < 6.6.26 | ≥ 6.7, < 6.8.5 | 6.9:rc1 | 6.9:rc2
Debian1 product
- linux< 6.1.85-1 | < 6.8.9-1
3 vendors · 126 products
