CVE-2024-56637

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A race condition in the Linux kernel's netfilter: ipset module can lead to a kernel crash. This occurs when user space unloads the ip set.ko module while it is requesting a set type backend module. The issue can be provoked by inserting a delay after the nfnl unlock() call.

Recommendations For versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider disabling the ip set.ko module until a patch is available. Restrict access to the vulnerable netfilter: ipset module to minimize the risk of exploitation. Avoid using the nfnl unlock() function in conjunction with mdelay() until the issue is resolved.