CVE-2024-56600

What it actually does

Failure path in inet6_create leaves a dangling sk pointer attached to the sock object after sock_init_data has bound it; subsequent release of the sk triggers use-after-free when the sock is later dereferenced.

Why it matters to the business

Kernel memory corruption can lead to local privilege escalation or system instability on affected Linux distributions; low exploitability reduces immediate risk but kernel-level flaws still require prompt patching to protect multi-tenant and network-facing systems.

How an attack unfolds

An attacker triggers the error path in inet6 socket creation (for example via specific IPv6 socket options or resource exhaustion) so that the sk is freed while the sock still holds a reference, then reuses the freed memory through subsequent socket operations to achieve arbitrary kernel read/write or code execution.

How to fix it

Update the Linux kernel to a version containing commit f2709d1271cfdf55c670ab5c5982139ab627ddc7 or later; apply vendor backports for stable branches and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit or package version; attempt to reproduce the original failure path in a test environment and verify the sock sk pointer is cleared on error.

Typical attack path

1. Create an IPv6 socket that reaches inet6_create
2. Force a failure after sock_init_data attaches the sk pointer
3. Trigger sk release while the sock retains the dangling pointer
4. Reclaim the freed sk memory via heap spraying or adjacent allocations
5. Perform operations on the socket that dereference the dangling pointer

How to detect it

Review kernel logs and audit trails for unusual IPv6 socket creation failures followed by crashes or privilege-escalation indicators; examine core dumps or KASAN reports referencing inet6_create or sock sk pointer dereferences.

What your security team should do

• Prioritize kernel updates on all systems exposing IPv6 sockets
• Monitor for new stable releases containing the referenced commit
• Restrict unprivileged IPv6 socket creation where feasible until patched