CVE-2024-38630: Linux kernel · watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 30 Oct 2026, 15:33 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or noneExploitation evidence
Disclosed: evidence found.
CVE published 21 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
AI-suggested
A fix has been implemented in the Linux kernel by replacing del_timer() with timer_shutdown_sync() in the cpu5wdt module. Users should apply the official kernel updates that include this fix once available.
Description
A use-after-free vulnerability was fixed in the Linux kernel's cpu5wdt watchdog module. The issue occurred when the timer handler cpu5wdt_trigger accessed a port region after it had been released, due to improper synchronization when removing the timer. The fix replaced del_timer() with timer_shutdown_sync() to ensure the timer handler completes before releasing the port region.
References
- git.kernel.org/stable/c/948ed659c0151a605bd126da1e95f350ec5a7956 (opens in a new tab)
- git.kernel.org/stable/c/9abe50e8492d1accd7d8dc17991179472d3d4573 (opens in a new tab)
- git.kernel.org/stable/c/9b1c063ffc075abf56f63e55d70b9778ff534314 (opens in a new tab)
- git.kernel.org/stable/c/f19686d616500cd0d47b30cee82392b53f7f784a (opens in a new tab)
- git.kernel.org/stable/c/573601521277119f2e2ba5f28ae6e87fc594f4d4 (opens in a new tab)