CVE-2024-44974 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-44974?

CVE-2024-44974 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's MPTCP subsystem. Attackers could potentially exploit this to cause kernel crashes or execute arbitrary code. Systems running affected Linux kernel versions with MPTCP enabled are vulnerable.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's MPTCP subsystem. Attackers could potentially exploit this to cause kernel crashes or execute arbitrary code. Systems running affected Linux kernel versions with MPTCP enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if MPTCP (Multipath TCP) is enabled and configured. Many distributions don't enable MPTCP by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

Kernel crash causing denial of service, potentially leading to system instability or reboot.

🟢

If Mitigated

No impact if MPTCP is disabled or systems are patched.

🌐 Internet-Facing: MEDIUM - Requires MPTCP connectivity and specific conditions to trigger, but could affect exposed services.

🏢 Internal Only: MEDIUM - Internal systems with MPTCP enabled could be vulnerable to local or network-based attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific conditions in MPTCP connection handling and kernel memory manipulation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 0201d65d9806d287a00e0ba96f0321835631f63f, 2b4f46f9503633dade75cb796dd1949d0e6581a1, 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d, 9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8, ddee5b4b6a1cc03c1e9921cf34382e094c2009f1

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify MPTCP functionality if required.

🔧 Temporary Workarounds

Disable MPTCP

linux

Disable Multipath TCP functionality if not required

sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled = 0' >> /etc/sysctl.conf
sysctl -p

🧯 If You Can't Patch

Disable MPTCP using sysctl commands
Implement network segmentation to limit MPTCP traffic to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check if MPTCP is enabled: sysctl net.mptcp.enabled. Check kernel version: uname -r and compare with patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and MPTCP is either disabled or running patched code. Check for presence of patch commits in kernel source.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
MPTCP connection errors
System crash/reboot events

Network Indicators:

Unusual MPTCP connection patterns
MPTCP protocol anomalies

SIEM Query:

source="kernel" AND ("panic" OR "oops") AND mptcp

📊 Metadata

CVE ID: CVE-2024-44974

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: September 4, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-44974, you might also want to check these: