CVE-2024-50293

What it actually does

Failure to clear sock->sk on error during AF_SMC socket creation in the Linux kernel leaves a dangling pointer, enabling subsequent use-after-free access in net/smc.

Why it matters to the business

Linux systems using SMC sockets face elevated risk of kernel instability, crashes, or potential privilege escalation; low EPSS and no KEV status indicate limited immediate widespread exploitation but still requires prompt patching on affected kernels.

How an attack unfolds

An attacker invokes socket creation with AF_SMC family and specific parameters that trigger failure paths in __smc_create, leaving the dangling sk pointer; this can be leveraged in subsequent operations to access freed memory, consistent with patterns seen in Linux kernel resource-handling issues exploited by espionage and financially motivated actors.

How to fix it

Apply the upstream fix from commit 2d859aff775d (and related 4bbd360a5084) by upgrading to a kernel containing the resolution for dangling sk pointers in pf->create functions; reboot after update.

How to confirm the fix worked

Confirm kernel version contains the fix; attempt socket creation with AF_SMC under failure conditions and verify no WARNING at net/socket.c:1563 or dangling pointer reports; review dmesg for related syzbot-style warnings.

Typical attack path

1. Trigger socket creation syscall with AF_SMC (family 43), SOCK_STREAM, protocol 0
2. Force failure inside __smc_create so sock->sk is not cleared
3. Reuse or dereference the dangling pointer via subsequent kernel operations
4. Achieve use-after-free for memory corruption or information disclosure

How to detect it

Search kernel logs for warnings referencing __sock_create, net/socket.c:1563, or "do not leave a dangling sk pointer"; inspect auditd or syscall traces for AF_SMC socket creation attempts by untrusted processes; review threat actor reports on Linux kernel resource initialization flaws for similar patterns.

What your security team should do

• Prioritize kernel updates on all systems exposing SMC sockets
• Monitor for new Linux kernel UAF or dangling pointer reports given 692 days since publication
• Harden socket creation paths with additional seccomp or LSM controls where feasible
• Include kernel socket family handling in regular fuzzing and static analysis pipelines