8.2

CVE-2024-45009: linux

CVSS: 8.2v3.1HighModified
AliasesUBUNTU-CVE-2024-45009DEBIAN-CVE-2024-45009
Published 11-09-2024Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2024-45009 is a high (CVSS 8.2) vulnerability in linux. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 18
DLA-4008-1DSA-5782-1RHSA-2025:6966SUSE-SU-2025:0784-1SUSE-SU-2025:0847-1SUSE-SU-2025:0856-1

Timeline

  1. 11-09-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

0.00 pp

From 0.52% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu117 products
  • linux< 5.15.0-125.135 | < 6.8.0-50.51
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1072.78 | < 6.8.0-1020.22
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ d0876b2284cf8b34dd214b2d0aa21071c345da59, < 35b31f5549ede4070566b949781e83495906b43d | ≥ d0876b2284cf8b34dd214b2d0aa21071c345da59, < 85b866e4c4e63a1d7afb58f1e24273caad03d0b7 | ≥ d0876b2284cf8b34dd214b2d0aa21071c345da59, < d20bf2c96d7ffd171299b32f562f70e5bf5dc608 | ≥ d0876b2284cf8b34dd214b2d0aa21071c345da59, < 2060f1efab370b496c4903b840844ecaff324c3c | ≥ d0876b2284cf8b34dd214b2d0aa21071c345da59, < 1c1f721375989579e46741f59523e39ec9b2a9bd | 5.10
  • linux_kernel≥ 5.10, < 5.15.167 | ≥ 5.16, < 6.1.107 | ≥ 6.2, < 6.6.48 | ≥ 6.7, < 6.10.7 | 6.11:rc1 | 6.11:rc2 | 6.11:rc3 | 6.11:rc4
Debian1 product
  • linux< 6.1.112-1 | < 6.10.7-1

3 vendors · 120 products

References

21 links
Show all 21 references