CVE-2024-46782

Q: What is the severity of CVE-2024-46782?

CVE-2024-46782 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's ILA (Identifier Locator Addressing) subsystem allows an attacker to cause a kernel crash or potentially execute arbitrary code. The vulnerability occurs when network hooks are unregistered after freeing a rhashtable, leading to memory corruption. This affects Linux systems with ILA functionality enabled.

7.8 HIGH

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's ILA (Identifier Locator Addressing) subsystem allows an attacker to cause a kernel crash or potentially execute arbitrary code. The vulnerability occurs when network hooks are unregistered after freeing a rhashtable, leading to memory corruption. This affects Linux systems with ILA functionality enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution).

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ILA (Identifier Locator Addressing) functionality is compiled into the kernel and enabled. Many distributions may not have ILA enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel-level code execution.

🟠

Likely Case

Kernel crash causing denial of service on affected systems.

🟢

If Mitigated

No impact if ILA functionality is disabled or systems are patched.

🌐 Internet-Facing: MEDIUM - Requires network access to trigger, but ILA is typically used in specific network configurations.

🏢 Internal Only: MEDIUM - Internal attackers with network access could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires network access to trigger the ILA functionality. The vulnerability was discovered through syzkaller fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 031ae72825cef43e4650140b800ad58bf7a6a466 or later

Vendor Advisory: https://git.kernel.org/stable/c/031ae72825cef43e4650140b800ad58bf7a6a466

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Disable ILA functionality

linux

Remove or disable the ILA kernel module if not required.

modprobe -r ila
echo 'blacklist ila' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable ILA functionality if not required
Implement network segmentation to limit access to systems with ILA enabled

🔍 How to Verify

Check if Vulnerable:

Check if ILA module is loaded: lsmod | grep ila. If loaded and kernel version is unpatched, system is vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version is patched: uname -r and verify against distribution security advisories.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN use-after-free reports in dmesg
System crashes

Network Indicators:

Unusual ILA-related network traffic patterns

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "ila")

📊 Metadata

CVE ID: CVE-2024-46782

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: September 18, 2024

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable ILA functionality

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities