CVE-2024-0582 is a high severity use after free flaw in Linux Kernel io_uring, scored CVSS 7.8. The record lists Linux kernel 6.7 release candidates. Take the upstream fix (commit c392cbecd8eca4c53f2bf508731257d9d0a21c2d in the record) or your distribution update where it applies. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists Linux kernel 6.7 release candidates. The flaw concerns IORING_REGISTER_PBUF_RING buffer rings that are registered, mapped with mmap and then freed.
A local user who registers a buffer ring, maps it, and frees it can trigger a memory leak that may lead to a crash or privilege escalation.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.8 (High). KEV status: not listed in the record.
Fixed version: Take the upstream fix (commit c392cbecd8eca4c53f2bf508731257d9d0a21c2d in the record) or your distribution update where it applies.
Where sources differ: Red Hat states that Red Hat Enterprise Linux is not affected, because the flawed upstream commit is not in any shipping kernel it uses. NVD scores the CVE 7.8 High and lists generic kernel versions. Red Hat also marks its CVSS metrics as preliminary. Check your own kernel before assuming exposure.
How to check if you're exposed
Print the running kernel and compare it with your distribution advisory.
uname -r
# Debian or Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# RHEL, Fedora and derivatives
rpm -q kernel
rpm -q --changelog kernel | grep -i CVE-2024-0582
If the changelog or your vendor advisory lists the CVE as fixed in the installed build, you are covered. Containers share the host kernel, so check the host, not the image.
What to do now
- Identify hosts and virtual machines running affected kernels.
- Install the kernel update from your distribution and reboot, or use live patching if your vendor supports it for this CVE.
- Restrict local shell access and unprivileged features where the advisory suggests it, since the flaw needs a local user.
- Rescan after patching to confirm the finding closes.
Why it matters
CWE-416 describes this class. A use after free is a memory safety bug. Code keeps using a pointer after the memory behind it has been released, so it reads or writes memory that may now belong to something else. In kernel code that can mean a crash or, in the worst case, a route to higher privileges for a local user.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-16.
For a wider view, a free in-browser dependency scan and the Gold directory show where Linux Kernel io_uring sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0582 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do containers need the kernel patch too?
Containers share the host kernel. Patch the host or node, not the container image.
Sources
- Red Hat CVE page
- Safeguard Gold entry for CVE-2024-0582
- NVD record data for CVE-2024-0582.
Last reviewed: 19 October 2026.
