Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U H H H 7.0 .0022 12.9 —
AFFECTED Product Versions Fixed Linux c7f2733e5011bfd136f1ca93497394d43aa76225 – — Linux 6.8 – 5.4.279
TIMELINE Jun 25 Reserved by Linux Jul 12 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-39503 (Linux). CVSS 7.8 → 7 (NVD).
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. The patch contains the following parts: - When destroying all sets, first remove the garbage collectors, then wait if needed and then destroy the sets. - Fix the badly ordered "wait then remove gc" for the destroy a single set case. - Fix the missing rcu locking in the list:set type in the userspace test case. - Use proper RCU list handlings in the list:set type. The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
| Date | Event | Detail |
|---|---|---|
| June 25, 2024 | Reserved | Reserved by Linux |
| July 12, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-39503 (Linux). CVSS 7.8 → 7 (NVD). |
Authoritative record: CVE-2024-39503 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-39503 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.