CVE-2024-56783

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description The issue concerns the netfilter component in the Linux kernel, specifically the nft socket. It involves removing an unnecessary WARN ON ONCE warning at the maximum cgroup level. By default, the maximum cgroup depth is INT MAX, but there is a cgroup toggle to restrict this depth to a more reasonable value to prevent performance harm. The removal of this warning is necessary because it is reachable from userspace.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider restricting the cgroup maximum depth to a more reasonable value using the available cgroup toggle to minimize potential performance impacts until the update can be applied.