---
id: CVE-2024-39503
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
  type


  Lion Ackermann reported that there is a race condition between namespace
  cleanup

  in ip…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  netfilter: ipset: Fix race between namespace cleanup and gc in the list:set
  type


  Lion Ackermann reported that there is a race condition between namespace
  cleanup

  in ip…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.4.269, < 5.4.279'
  - 'linux_kernel >= 5.10.210, < 5.10.221'
  - 'linux_kernel >= 5.15.149, < 5.15.162'
  - 'linux_kernel >= 6.1.79, < 6.1.95'
  - 'linux_kernel >= 6.6.18, < 6.6.35'
  - 'linux_kernel >= 6.7.6, < 6.8'
  - 'linux_kernel >= 6.8.1, < 6.9.6'
  - linux_kernel = 6.8
  - linux_kernel = 6.10
patched:
  - linux_kernel 6.9.6
published: '2024-07-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:34.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-39503'
references:
  - url: 'https://git.kernel.org/stable/c/0f1bb77c6d837c9513943bc7c08f04c5cc5c6568'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2ba35b37f780c6410bb4bba9c3072596d8576702'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/390b353d1a1da3e9c6c0fd14fe650d69063c95d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/90ae20d47de602198eb69e6cd7a3db3420abfc08'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93b53c202b51a69e42ca57f5a183f7e008e19f83'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0f1bb77c6d837c9513943bc7c08f04c5cc5c6568'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/2ba35b37f780c6410bb4bba9c3072596d8576702'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/390b353d1a1da3e9c6c0fd14fe650d69063c95d6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/90ae20d47de602198eb69e6cd7a3db3420abfc08'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/93b53c202b51a69e42ca57f5a183f7e008e19f83'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00221
epssPercentile: 0.11781
ingestedAt: '2026-10-15T03:30:12.718Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:07:04.128981Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

Lion Ackermann reported that there is a race condition between namespace cleanup
in ipset and the garbage collection of the list:set type. The namespace
cleanup can destroy the list:set type of sets while the gc of the set type is
waiting to run in rcu cleanup. The latter uses data from the destroyed set which
thus leads use after free. The patch contains the following parts:

- When destroying all sets, first remove the garbage collectors, then wait
  if needed and then destroy the sets.
- Fix the badly ordered "wait then remove gc" for the destroy a single set
  case.
- Fix the missing rcu locking in the list:set type in the userspace test
  case.
- Use proper RCU list handlings in the list:set type.

The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).

## Affected

- `linux_kernel >= 5.4.269, < 5.4.279`
- `linux_kernel >= 5.10.210, < 5.10.221`
- `linux_kernel >= 5.15.149, < 5.15.162`
- `linux_kernel >= 6.1.79, < 6.1.95`
- `linux_kernel >= 6.6.18, < 6.6.35`
- `linux_kernel >= 6.7.6, < 6.8`
- `linux_kernel >= 6.8.1, < 6.9.6`
- `linux_kernel = 6.8`
- `linux_kernel = 6.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.6`