CVE-2024-53206

What it actually does

Use-after-free of the nreq object in reqsk_timer_handler() when a request socket migrates and a retry attempt fails, allowing memory corruption in the Linux kernel TCP stack.

Why it matters to the business

Kernel crashes or instability on Linux systems under network load can interrupt services, reduce availability, and require emergency reboots or patching across fleets.

How an attack unfolds

An attacker sends TCP connection requests that trigger socket migration in the kernel; when the retry timer fires after a failure condition such as timeout, the handler frees the wrong object and later accesses the freed nreq, leading to memory corruption.

How to fix it

Upgrade the Linux kernel to version 5.15.174 or later; apply the corresponding vendor backports for all supported branches and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel reports a version at or above 5.15.174; review dmesg and kernel logs for absence of use-after-free warnings in reqsk_timer_handler after applying the update.

Typical attack path

1. Send crafted TCP SYN packets to trigger request socket allocation
2. Force conditions that cause reqsk migration between CPU or queue structures
3. Induce retry failure (timeout or drop) so the timer handler executes
4. Trigger use-after-free access to the freed nreq object during cleanup

How to detect it

Search kernel logs and audit trails for oops, panic, or warning messages referencing reqsk_timer_handler or nreq use-after-free; correlate with network connection spikes or migration events.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and high-traffic Linux systems within the published remediation window
• Monitor kernel crash and oops logs for TCP request socket timer activity
• Test the patch in a staging environment that reproduces high connection churn before broad rollout