CVE-2024-57841

What it actually does

Memory leak in tcp_conn_request() when inet_csk_reqsk_queue_hash_add() returns false, leaving dst memory allocated by af_ops->route_req unreleased.

Why it matters to the business

Gradual kernel memory exhaustion on systems under sustained TCP connection attempts, potentially causing performance degradation, increased latency, or eventual system instability requiring reboots.

How an attack unfolds

An attacker sends crafted TCP SYN packets that cause inet_csk_reqsk_queue_hash_add() to fail in the connection request path, triggering repeated allocations of dst objects without corresponding frees, leading to unreferenced memory accumulation visible via kmemleak.

How to fix it

Upgrade Linux kernel to version 5.15.176 or later, or apply the patch that adds dst_release() before returning on hash add failure; for GIT sources apply commit 9d38959677291552d1b0ed2689a540af279b5bf8.

How to confirm the fix worked

Verify running kernel version is at or above 5.15.176; enable kmemleak and confirm absence of the reported backtrace involving tcp_conn_request and dst_alloc; test with synthetic SYN floods that previously triggered the leak.

Typical attack path

1. Send high volume of TCP SYN packets targeting the vulnerable kernel path
2. Trigger failure in inet_csk_reqsk_queue_hash_add() during tcp_conn_request()
3. Accumulate unreleased dst memory allocations from ip_route_output_flow and related routing calls
4. Monitor for gradual memory growth until system impact occurs

How to detect it

Inspect kmemleak reports for unreferenced objects allocated via dst_alloc in the tcp_conn_request backtrace; correlate with high volumes of failed TCP connection requests in network logs.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or high-traffic systems within the next maintenance window
• Monitor kernel memory usage and enable kmemleak on test systems to validate the fix
• Review and apply distribution-specific backports if running older stable kernels