CVE-2024-56601

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A vulnerability in the Linux kernel has been resolved, where the inet create() function could leave a dangling sk pointer. The sock init data() function attaches the allocated sk object to the provided sock object. If inet create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create a use-after-free issue later. The fix involves clearing the sk pointer in the sock object on error.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider implementing custom error handling to clear the sk pointer in the sock object when inet create() fails.