Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0052 42.2 —
AFFECTED Product Versions Fixed Linux d0876b2284cf8b34dd214b2d0aa21071c345da59 – — Linux 5.10 – 5.15.167
TIMELINE Aug 21 Reserved by Linux Sep 11 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-45009 (Linux). CVSS 8.2 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR.
| Date | Event | Detail |
|---|---|---|
| August 21, 2024 | Reserved | Reserved by Linux |
| September 11, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-45009 (Linux). CVSS 8.2 → 5.5 (NVD). |
Authoritative record: CVE-2024-45009 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-45009 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.