5.5

CVE-2024-46702: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-46702DEBIAN-CVE-2024-46702
Published 13-09-2024Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2024-46702 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 22
DLA-3912-1DLA-4008-1DSA-5782-1SUSE-SU-2024:3551-1SUSE-SU-2024:3553-1SUSE-SU-2024:3559-1

Timeline

  1. 13-09-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu130 products
  • linuxAll versions (No fix recorded) | < 5.15.0-125.135 | < 6.8.0-50.51
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1072.78 | < 6.8.0-1020.22
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < 747bc154577de6e6af4bc99abfa859b8419bb4d8 | ≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < 23ce6ba3b95488a2b9e9f6d43b340da0c15395dc | ≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < 80ac8d194831eca0c2f4fd862f7925532fda320c | ≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < 18b3ad2a3cc877dd4b16f48d84aa27b78d53bf1d | ≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < 7ca24cf9163c112bb6b580c6fb57c04a1f8b76e1 | ≥ 16603153666d22df544ae9f9b3764fd18da28eeb, < e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d | 3.17
  • linux_kernel< 5.10.225 | ≥ 5.11, < 5.15.166 | ≥ 5.16, < 6.1.107 | ≥ 6.2, < 6.6.48 | ≥ 6.7, < 6.10.7 | 6.11:rc1 | 6.11:rc2 | 6.11:rc3
Debian1 product
  • linux< 6.1.112-1 | < 6.10.7-1

3 vendors · 133 products

References

23 links
Show all 23 references