CVE-2024-36886

Q: What is the severity of CVE-2024-36886?

CVE-2024-36886 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol implementation. When exploited, it allows attackers to potentially execute arbitrary code or cause denial of service on affected systems. Any system running a vulnerable Linux kernel with TIPC enabled is affected.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol implementation. When exploited, it allows attackers to potentially execute arbitrary code or cause denial of service on affected systems. Any system running a vulnerable Linux kernel with TIPC enabled is affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if TIPC protocol is enabled and configured. Many distributions disable TIPC by default or compile it as a module.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to full system compromise, privilege escalation to kernel level, or persistent backdoor installation.

🟠

Likely Case

Kernel panic leading to system crash and denial of service, potentially requiring physical access to restart affected systems.

🟢

If Mitigated

Limited impact if TIPC is disabled or systems are properly segmented, though kernel crashes could still occur.

🌐 Internet-Facing: MEDIUM - Requires TIPC to be enabled and reachable, which is less common in internet-facing configurations.

🏢 Internal Only: HIGH - Internal systems with TIPC enabled could be exploited by attackers who gain internal network access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

The vulnerability is in the error handling path of tipc_buf_append(), requiring specific conditions to trigger. Proof-of-concept code was included in the original report.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 080cbb890286cd794f1ee788bbc5463e2deb7c2b, 21ea04aad8a0839b4ec27ef1691ca480620e8e14, 367766ff9e407f8a68409b7ce4dc4d5a72afeab1, 66116556076f0b96bc1aa9844008c743c8c67684, 93bc2d6d16f2c3178736ba6b845b30475856dc40

Vendor Advisory: https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable TIPC module

linux

Prevent loading of the TIPC kernel module to mitigate the vulnerability

echo 'install tipc /bin/true' >> /etc/modprobe.d/disable-tipc.conf
rmmod tipc

Block TIPC traffic

linux

Use iptables to block TIPC protocol (port 6118 typically)

iptables -A INPUT -p udp --dport 6118 -j DROP
iptables -A OUTPUT -p udp --dport 6118 -j DROP

🧯 If You Can't Patch

Disable TIPC protocol completely if not required for system functionality
Implement strict network segmentation to isolate systems with TIPC enabled

🔍 How to Verify

Check if Vulnerable:

Check if TIPC module is loaded: lsmod | grep tipc. If loaded and kernel version is vulnerable, system is at risk.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against distribution's patched versions and verify TIPC module is either not loaded or system has been updated.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free in tipc_buf_append()
System crashes or unexpected reboots

Network Indicators:

Unusual UDP traffic on port 6118 (TIPC default)
Network scans targeting TIPC ports

SIEM Query:

source="kernel" AND ("tipc" OR "KASAN: slab-use-after-free" OR "BUG: KASAN")

📊 Metadata

CVE ID: CVE-2024-36886

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 30, 2024

Last Updated: January 22, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable TIPC module

Block TIPC traffic

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities