CVE-2024-38612

HighCVSS 7.0/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix invalid unregister error path

The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called.

This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() with genl_unregister_family() in this error path.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-386134.7In the Linux kernel, the following vulnerability has been resolved: m68k: Fix spinlock race in kernel thread creation Context switching doCVE-2024-386145.5In the Linux kernel, the following vulnerability has been resolved: openrisc: traps: Don't send signals to kernel mode threads OpenRISC exCVE-2024-386155.5In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional aCVE-2024-386168.2In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: re-fix fortified-memset warning The carl9170_tx_releasCVE-2024-386175.5In the Linux kernel, the following vulnerability has been resolved: kunit/fortify: Fix mismatched kvalloc()/vfree() usage The kv*() familyCVE-2024-386185.5In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer dCVE-2024-386195.5In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The memberCVE-2024-38625.3The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. ThCVE-2024-386205.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCICVE-2024-386217.1In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtraCVE-2024-386225.5In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpCVE-2024-386237.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix s
CVE-2024-38612: High severity, CVSS 7.0 | Vulnix