CVE-2024-53168

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc4-dirty

Description A use-after-free issue has been identified in the Linux kernel's sunrpc module, specifically related to the kernel's TCP socket handling. This issue arises when the TCP socket in a network namespace is shut down and closed, but the FIN message with acknowledgement is discarded, leading to the nfsd side continuing to send retransmission messages. As a result, when the TCP socket processes the received message, it sends the FIN message in the sending queue, and the TCP timer is re-established, causing problems when the network namespace is deleted.

Recommendations To resolve this issue, hold the netns refcnt for the TCP kernel socket as done in other modules. This can be backported to earlier kernels. A proper fix that cleans up the interfaces will follow, but may not be easy to backport. For versions prior to 6.12.0-rc4-dirty, consider applying the provided fix or waiting for an official patch.