Security researchers have publicly released a proof-of-concept (PoC) exploit for CVE-2024-36904, a critical use-after-free vulnerability in the Linux kernel that has remained undetected for seven years. System administrators should prioritize updating to the latest kernel versions containing the security patches to mitigate this long-standing vulnerability. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability, which affects the TCP subsystem, could potentially allow attackers to execute remote code with kernel privileges. When successfully leveraged, this use-after-free condition could allow attackers to execute arbitrary code within the kernel context, potentially leading to complete system compromise. For the Red Hat Enterprise Linux 9 ecosystem specifically, the vulnerability was fixed in kernel 5.14-427.26.1 on July 16, 2024. The researchers explained their PoC: “In the original kernel version, the syzkaller reproducer takes many hours to trigger the reference counter warnings. Further, all experiments were conducted on Alma Linux 9 with kernel version 5.14.0-362.24.2.el9_3.x86_64, running as a virtual machine on VMware Workstation. This vulnerability affects numerous Linux distributions, including Red Hat Enterprise Linux derivatives and Fedora.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Mar 2025 09:40:14 +0000