PT-2024-36868

CVE-2024-56563

Published

2024-11-23

Updated

2025-09-23

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A credential leak issue has been resolved in the Linux kernel. The problem occurred because get current cred() increments the reference counter, but the corresponding put cred() call was missing in the ceph mds check access() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Researchers

Max Kellermann

Vendors

Affected products

Weakness enumeration

CWE-763: Release of Invalid Pointer or Reference

CWE-664: Improper Control of a Resource Through its Lifetime

CWE-911: Improper Update of Reference Count

Related identifiers