# CVE-2024-50085: linux: In the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_o...

CVE-2024-50085 is fixed in 47 products on 1 platform, first by DEBIAN-CVE-2024-50085, released October 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-50085
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0048
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 29, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow  Syzkaller reported this splat:    ==================================================================   BUG: KASAN: slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881   Read of size 4 at addr ffff8880569ac858 by task syz.1.2799/14662    CPU: 0 UID: 0 PID: 14662 Comm: syz.1.2799 Not tainted 6.12.0-rc2-syzkaller-00307-g36c254515dc6 #0   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014   Call Trace:    <TASK>    __dump_stack lib/dump_stack.c:94 [inline]    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120    print_address_description mm/kasan/report.c:377 [inline]    print_report+0xc3/0x620 mm/kasan/report.c:488    kasan_report+0xd9/0x110 mm/kasan/report.c:601    mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:914 [inline]    mptcp_nl_remove_id_zero_address+0x305/0x4a0 net/mptcp/pm_netlink.c:1572    mptcp_pm_nl_del_addr_doit+0x5c9/0x770 net/mptcp/pm_netlink.c:1603    genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2551    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]    netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1357    netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901    sock_sendmsg_nosec net/socket.c:729 [inline]    __sock_sendmsg net/socket.c:744 [inline]    ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2607    ___sys_sendmsg+0x135/0x1e0 net/socket.c:2661    __sys_sendmsg+0x117/0x1f0 net/socket.c:2690    do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]    __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386    do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411    entry_SYSENTER_compat_after_hwframe+0x84/0x8e   RIP: 0023:0xf7fe4579   Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00   RSP: 002b:00000000f574556c EFLAGS: 00000296 ORIG_RAX: 0000000000000172   RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000020000140   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000   R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000    </TASK>    Allocated by task 5387:    kasan_save_stack+0x33/0x60 mm/kasan/common.c:47    kasan_save_track+0x14/0x30 mm/kasan/common.c:68    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]    __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394    kmalloc_noprof include/linux/slab.h:878 [inline]    kzalloc_noprof include/linux/slab.h:1014 [inline]    subflow_create_ctx+0x87/0x2a0 net/mptcp/subflow.c:1803    subflow_ulp_init+0xc3/0x4d0 net/mptcp/subflow.c:1956    __tcp_set_ulp net/ipv4/tcp_ulp.c:146 [inline]    tcp_set_ulp+0x326/0x7f0 net/ipv4/tcp_ulp.c:167    mptcp_subflow_create_socket+0x4ae/0x10a0 net/mptcp/subflow.c:1764    __mptcp_subflow_connect+0x3cc/0x1490 net/mptcp/subflow.c:1592    mptcp_pm_create_subflow_or_signal_addr+0xbda/0x23a0 net/mptcp/pm_netlink.c:642    mptcp_pm_nl_fully_established net/mptcp/pm_netlink.c:650 [inline]    mptcp_pm_nl_work+0x3a1/0x4f0 net/mptcp/pm_netlink.c:943    mptcp_worker+0x15a/0x1240 net/mptcp/protocol.c:2777    process_one_work+0x958/0x1b30 kernel/workqueue.c:3229    process_scheduled_works kernel/workqueue.c:3310 [inline]    worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391    kthread+0x2c1/0x3a0 kernel/kthread.c:389    ret_from_fork+0x45/0x80 arch/x86/ke ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bpftool amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | bpftool-debuginfo amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | dtb-aarch64 opensuse-leap 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-64kb opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-64kb sles 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-azure opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-azure sles 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-coco sles 15.6 | 6.4.0-15061.18.coco15sp6.1 | [SUSE-SU-2025:0784-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0784-1.md) | Mar 5, 2025 |
| Linux | kernel-coco_debug sles 15.6 | 6.4.0-15061.18.coco15sp6.1 | [SUSE-SU-2025:0784-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0784-1.md) | Mar 5, 2025 |
| Linux | kernel-debug opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-debuginfo amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-debuginfo-common-aarch64 amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-debuginfo-common-x86_64 amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-default opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-default sles 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-default-base opensuse-leap 15.6 | 6.4.0-150600.23.42.2.150600.12.18.4 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-default-base sles 15.6 | 6.4.0-150600.23.42.2.150600.12.18.4 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-devel amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-docs opensuse-leap 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-docs sles 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-headers amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-kvmsmall opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-libbpf amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-libbpf-devel amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-libbpf-static amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-livepatch-6.1.115-126.197 amzn 2023 | 1.0-0.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-livepatch-SLE15-SP6-RT_Update_9 sles 15.6 | 1-150600.1.3.2 | [SUSE-SU-2025:0955-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0955-1.md) | Mar 19, 2025 |
| Linux | kernel-livepatch-SLE15-SP6_Update_9 sles 15.6 | 1-150600.13.3.4 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-modules-extra amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-modules-extra-common amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-obs-build opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-obs-build sles 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-obs-qa opensuse-leap 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-rt opensuse-leap 15.6 | 6.4.0-150600.10.29.1 | [SUSE-SU-2025:0955-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0955-1.md) | Mar 19, 2025 |
| Linux | kernel-rt_debug opensuse-leap 15.6 | 6.4.0-150600.10.29.1 | [SUSE-SU-2025:0955-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0955-1.md) | Mar 19, 2025 |
| Linux | kernel-source opensuse-leap 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-source sles 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-source-azure opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-source-azure sles 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-source-coco sles 15.6 | 6.4.0-15061.18.coco15sp6.1 | [SUSE-SU-2025:0784-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0784-1.md) | Mar 5, 2025 |
| Linux | kernel-source-rt opensuse-leap 15.6 | 6.4.0-150600.10.29.1 | [SUSE-SU-2025:0955-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0955-1.md) | Mar 19, 2025 |
| Linux | kernel-syms opensuse-leap 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-syms sles 15.6 | 6.4.0-150600.23.42.1 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-syms-azure opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-syms-azure sles 15.6 | 6.4.0-150600.8.31.1 | [SUSE-SU-2025:0847-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0847-1.md) | Mar 12, 2025 |
| Linux | kernel-syms-coco sles 15.6 | 6.4.0-15061.18.coco15sp6.1 | [SUSE-SU-2025:0784-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0784-1.md) | Mar 5, 2025 |
| Linux | kernel-syms-rt opensuse-leap 15.6 | 6.4.0-150600.10.29.1 | [SUSE-SU-2025:0955-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0955-1.md) | Mar 19, 2025 |
| Linux | kernel-tools amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-tools-debuginfo amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-tools-devel amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | kernel-zfcpdump opensuse-leap 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | kernel-zfcpdump sles 15.6 | 6.4.0-150600.23.42.2 | [SUSE-SU-2025:0856-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0856-1.md) | Mar 13, 2025 |
| Linux | linux Debian 12.15 (bookworm) | 6.1.115-1 | [DEBIAN-CVE-2024-50085](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50085.md) | Oct 29, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.11.5-1 | [DEBIAN-CVE-2024-50085](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50085.md) | Oct 29, 2024 |
| Linux | linux Debian 14 | 6.11.5-1 | [DEBIAN-CVE-2024-50085](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50085.md) | Oct 29, 2024 |
| Linux | perf amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | perf-debuginfo amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | python3-perf amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |
| Linux | python3-perf-debuginfo amzn 2023 | 6.1.115-126.197.amzn2023 | [ALAS2023-2025-794](https://patchblox.com/security/data/fix/linux/alas2023-2025-794.md) | Jan 6, 2025 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.