CVE-2024-56601

What it actually does

sock_init_data() attaches an sk object to the sock; later failure in inet_create() frees the sk while leaving a dangling pointer in the sock, enabling use-after-free.

Why it matters to the business

Linux kernel systems may experience crashes, memory corruption, or privilege escalation, disrupting servers, networking services, and increasing risk of compromise.

How an attack unfolds

An attacker crafts network socket creation that triggers an error path after sock_init_data() but before cleanup, then reuses the dangling sk pointer to achieve use-after-free for code execution or information leak.

How to fix it

Upgrade the Linux kernel to the fixed commit f8a3f255f7509a209292871715cda03779640c8d or later stable releases containing the patch that clears the sk pointer on error.

How to confirm the fix worked

Verify the running kernel contains commit f8a3f255f7509a209292871715cda03779640c8d; inspect inet_create() source for the added sk pointer clearing on error paths.

Typical attack path

1. Trigger inet_create() via socket() or related syscall
2. Force failure after sock_init_data() attaches sk
3. Reuse the freed sk object through the retained sock pointer
4. Leverage UAF for memory corruption or privilege escalation

How to detect it

Examine kernel logs for oops or panic messages involving inet_create or sock structures; look for unexpected use-after-free reports in dmesg or crash dumps on systems prior to the fix.

What your security team should do

• Apply the kernel patch or upgrade to a fixed version immediately on all affected systems
• Monitor for kernel stability issues and schedule maintenance windows for reboot-required updates
• Review socket-related code paths in custom modules or drivers for similar patterns