CVE-2024-49944

What it actually does

Failure to reset sk_state to CLOSED after sctp_autobind fails in sctp_listen_start leaves bind_hash NULL while sk_state remains LISTENING; subsequent sctp_inet_listen calls with SCTP_REUSE_PORT dereference the null pointer, causing a kernel null-ptr-deref crash.

Why it matters to the business

Local denial-of-service crashes on Linux systems using SCTP can interrupt services and require reboots; the flaw has been public for over two years with a low but stable exploit probability and no known ransomware use.

How an attack unfolds

An attacker with local access invokes setsockopt(SCTP_REUSE_PORT), triggers a failing sctp_autobind inside sctp_listen_start, then calls listen again; the kernel path in sctp_inet_listen dereferences the still-LISTENING socket's null bind_hash, producing a KASAN-detected crash. No named threat actors have been linked to this specific issue.

How to fix it

Upgrade the Linux kernel to commit 89bbead9d897c77d0b566349c8643030ff2abeba or later; for Rocky Linux 8 users of p11-kit apply package 0:0.23.22-1.el8 or newer. Reboot after installing the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 89bbead9d897c77d0b566349c8643030ff2abeba; attempt to reproduce the original reproducer sequence and verify that sk_state is reset to CLOSED on autobind failure and that no null dereference occurs.

Typical attack path

1. Obtain local user privileges on a Linux host with SCTP enabled
2. Call setsockopt(SCTP_REUSE_PORT) on an SCTP socket
3. Invoke listen() such that sctp_autobind fails
4. Re-invoke listen() to trigger the null dereference in sctp_inet_listen

How to detect it

Review kernel logs for KASAN null-ptr-deref reports citing sctp_inet_listen and net/sctp/socket.c around line 8617; correlate with processes that performed SCTP socket operations immediately prior to the crash.

What your security team should do

• Prioritize kernel updates on all SCTP-enabled systems within standard patch windows
• Monitor upstream stable branches for backports of the referenced commit
• Restrict untrusted local accounts where possible until patches are applied