CVE-2024-49936 is a use-after-free vulnerability in the Linux kernel's net/xen-netback subsystem, specifically in the xenvif_flush_hash() function. The issue arises because kfree_rcu is called outside the RCU read critical section during list iteration, leading to potential use-after-free when accessing freed memory. This flaw has been fixed by changing the iteration method to list_for_each_entry_safe. The vulnerability affects multiple Linux kernel versions, including various 4.x and 5.x versions used in Ubuntu Azure kernels. A high-severity CVSS 3.1 score of 8.8 is assigned. Official patches are available and have been released in updated kernel versions.