Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0027 19.8 —
AFFECTED Product Versions Fixed Linux 40d8abdee806d496a60ee607a6d01b1cd7fabaf0 – — Linux 4.7 – 5.4.290
TIMELINE Oct 21 Reserved by Linux Oct 21 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-49936 (Linux). CVSS 8.8 → 7.8 (NVD).
In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe.
| Date | Event | Detail |
|---|---|---|
| October 21, 2024 | Reserved | Reserved by Linux |
| October 21, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-49936 (Linux). CVSS 8.8 → 7.8 (NVD). |
Authoritative record: CVE-2024-49936 at cve.org
Vendors: linux
Weaknesses: CWE-416
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-49936 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.