Vulnerability-Lookup

SUSE-SU-2025:1232-1

Vulnerability from csaf_suse - Published: 2025-04-14 09:04 - Updated: 2025-04-14 09:04

Summary

Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)

Description of the patch: This update for the Linux Kernel 6.4.0-150600_21 fixes several issues. The following security issues were fixed: - CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235218). - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228714).

Patchnames: SUSE-2025-1232,SUSE-2025-1233,SUSE-2025-1234,SUSE-2025-1239,SUSE-2025-1243,SUSE-SLE-Module-Live-Patching-15-SP4-2025-1232,SUSE-SLE-Module-Live-Patching-15-SP5-2025-1234,SUSE-SLE-Module-Live-Patching-15-SP6-2025-1239

CVE-2024-41090

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 9 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-56600

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2024-41090

Threats

Impact important

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2025…	self
https://bugzilla.suse.com/1228714	self
https://bugzilla.suse.com/1235218	self
https://www.suse.com/security/cve/CVE-2024-41090/	self
https://www.suse.com/security/cve/CVE-2024-56600/	self
https://www.suse.com/security/cve/CVE-2024-41090	external
https://bugzilla.suse.com/1228328	external
https://bugzilla.suse.com/1228714	external
https://www.suse.com/security/cve/CVE-2024-56600	external
https://bugzilla.suse.com/1235217	external
https://bugzilla.suse.com/1235218	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for the Linux Kernel 6.4.0-150600_21 fixes several issues.\n\nThe following security issues were fixed:\n\n- CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235218).\n- CVE-2024-41090: tap: add missing verification for short frame (bsc#1228714).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-1232,SUSE-2025-1233,SUSE-2025-1234,SUSE-2025-1239,SUSE-2025-1243,SUSE-SLE-Module-Live-Patching-15-SP4-2025-1232,SUSE-SLE-Module-Live-Patching-15-SP5-2025-1234,SUSE-SLE-Module-Live-Patching-15-SP6-2025-1239",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_1232-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:1232-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20251232-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:1232-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-April/038976.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1228714",
        "url": "https://bugzilla.suse.com/1228714"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235218",
        "url": "https://bugzilla.suse.com/1235218"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-41090 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-41090/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-56600 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-56600/"
      }
    ],
    "title": "Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)",
    "tracking": {
      "current_release_date": "2025-04-14T09:04:21Z",
      "generator": {
        "date": "2025-04-14T09:04:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:1232-1",
      "initial_release_date": "2025-04-14T09:04:21Z",
      "revision_history": [
        {
          "date": "2025-04-14T09:04:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
                  "product_id": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.ppc64le",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.ppc64le",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
                  "product_id": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.s390x",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.s390x",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.s390x",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.s390x",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
                  "product_id": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.x86_64",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_52-default-16-150500.2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.x86_64",
                  "product_id": "kernel-livepatch-5_14_21-150500_55_65-default-14-150500.2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Live Patching 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Live Patching 15 SP4",
                  "product_id": "SUSE Linux Enterprise Live Patching 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-live-patching:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Live Patching 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Live Patching 15 SP5",
                  "product_id": "SUSE Linux Enterprise Live Patching 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-live-patching:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Live Patching 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Live Patching 15 SP6",
                  "product_id": "SUSE Linux Enterprise Live Patching 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-live-patching:15:sp6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le"
        },
        "product_reference": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x"
        },
        "product_reference": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64"
        },
        "product_reference": "kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le"
        },
        "product_reference": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x"
        },
        "product_reference": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64"
        },
        "product_reference": "kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-41090",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-41090"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\n\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\n\nCVE: CVE-2024-41090",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-41090",
          "url": "https://www.suse.com/security/cve/CVE-2024-41090"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1228328 for CVE-2024-41090",
          "url": "https://bugzilla.suse.com/1228328"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1228714 for CVE-2024-41090",
          "url": "https://bugzilla.suse.com/1228714"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-14T09:04:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-41090"
    },
    {
      "cve": "CVE-2024-56600",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-56600"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet6: do not leave a dangling sk pointer in inet6_create()\n\nsock_init_data() attaches the allocated sk pointer to the provided sock\nobject. If inet6_create() fails later, the sk object is released, but the\nsock object retains the dangling sk pointer, which may cause use-after-free\nlater.\n\nClear the sock sk pointer on error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-56600",
          "url": "https://www.suse.com/security/cve/CVE-2024-56600"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235217 for CVE-2024-56600",
          "url": "https://bugzilla.suse.com/1235217"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235218 for CVE-2024-56600",
          "url": "https://bugzilla.suse.com/1235218"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_125-default-10-150400.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_62-default-14-150500.2.1.x86_64",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-14-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-14T09:04:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-56600"
    }
  ]
}

CVE-2024-41090 (GCVE-0-2024-41090)

Vulnerability from cvelistv5 – Published: 2024-07-29 06:18 – Updated: 2026-08-05 11:35

Title

tap: add missing verification for short frame

Summary

In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:24 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/8be915fc5ff9a5e29…
https://git.kernel.org/stable/c/7431144b406ae8280…
https://git.kernel.org/stable/c/e5e5e63c506b93b89…
https://git.kernel.org/stable/c/ee93e6da30377cf2a…
https://git.kernel.org/stable/c/aa6a5704cab861c9b…
https://git.kernel.org/stable/c/73d462a38d5f782b7…
https://git.kernel.org/stable/c/e1a786b9bbb767fd1…
https://git.kernel.org/stable/c/ed7f2afdd0e043a39…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 8be915fc5ff9a5e296f6538be12ea75a1a93bdea (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 7431144b406ae82807eb87d8c98e518475b0450f (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < e5e5e63c506b93b89b01f522b6a7343585f784e6 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < ee93e6da30377cf2a75e16cd32bb9fcd86a61c46 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < aa6a5704cab861c9b2ae9f475076e1881e87f5aa (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < 73d462a38d5f782b7c872fe9ae8393d9ef5483da (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < e1a786b9bbb767fd1c922d424aaa8078cc542309 (git) Affected: 0efac27791ee068075d80f07c55a229b1335ce12 , < ed7f2afdd0e043a397677e597ced0830b83ba0b3 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.281 , ≤ 5.4.* (semver) Unaffected: 5.10.223 , ≤ 5.10.* (semver) Unaffected: 5.15.164 , ≤ 5.15.* (semver) Unaffected: 6.1.102 , ≤ 6.1.* (semver) Unaffected: 6.6.43 , ≤ 6.6.* (semver) Unaffected: 6.9.12 , ≤ 6.9.* (semver) Unaffected: 6.10.2 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:46.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:59.280166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:06.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8be915fc5ff9a5e296f6538be12ea75a1a93bdea",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "7431144b406ae82807eb87d8c98e518475b0450f",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e5e5e63c506b93b89b01f522b6a7343585f784e6",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ee93e6da30377cf2a75e16cd32bb9fcd86a61c46",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "aa6a5704cab861c9b2ae9f475076e1881e87f5aa",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "73d462a38d5f782b7c872fe9ae8393d9ef5483da",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e1a786b9bbb767fd1c922d424aaa8078cc542309",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ed7f2afdd0e043a397677e597ced0830b83ba0b3",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.281",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.102",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.43",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\n\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\n\nCVE: CVE-2024-41090"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through vhost-net\u0027s batched XDP TX path, driven either by a guest VM\u0027s TX virtqueue on the same host or by a local process holding /dev/vhost-net plus a macvtap/ipvtap fd. Data arrives via shared memory rings, not from a remote network peer, so this is local rather than network access.\nAC:L - The attacker simply posts a TX descriptor whose payload is shorter than 14 bytes and kicks the virtqueue; vhost_net_build_xdp() only rejects len \u003c sock_hlen, so the short frame reaches tap_get_user_xdp() deterministically. The XDP batch path is active in the default QEMU configuration (unlimited sndbuf), and can be retried indefinitely.\nPR:L - The attacker must be an authorized guest VM on the host, or a local user with access to /dev/vhost-net and a tap/macvtap character device \u2014 some privilege, but nothing resembling host root. No CAP_SYS_ADMIN or init-namespace root is needed to trigger the path.\nUI:N - The malformed frame is processed entirely by the vhost worker kthread as soon as the guest kicks the ring; no host administrator or victim action is involved.\nS:C - A guest VM with zero host privileges corrupts host-kernel skb state and leaks host heap contents, crossing the guest/host virtualization boundary; the impacted resources (host kernel, physical NIC path, peer macvtap interfaces belonging to other tenants) lie outside the attacking guest\u0027s security authority.\nC:H - skb-\u003eprotocol is populated from eth_hdr() bytes that were never copied from the guest, exposing uninitialized page_frag memory that can contain remnants of previously transmitted host/other-guest packets, and the sub-ETH_HLEN skb causes downstream code to read beyond the actual frame length. The resulting memory-disclosure primitive is not bounded to a trivial value.\nI:H - A corrupted skb with network_header pointing past skb-\u003etail is passed to dev_queue_xmit(), so lower-layer drivers and offload code compute header lengths that underflow to enormous unsigned values, yielding out-of-bounds accesses and DMA/copy lengths attacker-influencing kernel memory. Such skb metadata corruption is leverageable for control-flow-relevant memory corruption.\nA:H - The out-of-bounds accesses and inconsistent header offsets in downstream network drivers readily produce a kernel oops or panic on the host, and the guest can repeat the trigger at will to keep the host down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:18.598Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
        }
      ],
      "title": "tap: add missing verification for short frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41090",
    "datePublished": "2024-07-29T06:18:10.896Z",
    "dateReserved": "2024-07-12T12:17:45.635Z",
    "dateUpdated": "2026-08-05T11:35:18.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-56600 (GCVE-0-2024-56600)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-08-05 11:45

Title

net: inet6: do not leave a dangling sk pointer in inet6_create()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-11 15:42 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/f2709d1271cfdf55c…
https://git.kernel.org/stable/c/35360255ca30776de…
https://git.kernel.org/stable/c/276a473c956fb55a6…
https://git.kernel.org/stable/c/79e16a0d339532ea8…
https://git.kernel.org/stable/c/706b07b7b37f88642…
https://git.kernel.org/stable/c/f44fceb71d72d29fb…
https://git.kernel.org/stable/c/9df99c395d0f55fb4…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f2709d1271cfdf55c670ab5c5982139ab627ddc7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 35360255ca30776dee34d9fa764cffa24d0a5f65 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 276a473c956fb55a6f3affa9ff232e10fffa7b43 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 79e16a0d339532ea832d85798eb036fc4f9e0cea (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 706b07b7b37f886423846cb38919132090bc40da (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f44fceb71d72d29fb00e0ac84cdf9c081b03cd06 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9df99c395d0f55fb444ef39f4d6f194ca437d884 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.4.287 , ≤ 5.4.* (semver) Unaffected: 5.10.231 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:42:30.859070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:24.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:38.144Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/af_inet6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2709d1271cfdf55c670ab5c5982139ab627ddc7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "35360255ca30776dee34d9fa764cffa24d0a5f65",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "276a473c956fb55a6f3affa9ff232e10fffa7b43",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "79e16a0d339532ea832d85798eb036fc4f9e0cea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "706b07b7b37f886423846cb38919132090bc40da",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f44fceb71d72d29fb00e0ac84cdf9c081b03cd06",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9df99c395d0f55fb444ef39f4d6f194ca437d884",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/af_inet6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet6: do not leave a dangling sk pointer in inet6_create()\n\nsock_init_data() attaches the allocated sk pointer to the provided sock\nobject. If inet6_create() fails later, the sk object is released, but the\nsock object retains the dangling sk pointer, which may cause use-after-free\nlater.\n\nClear the sock sk pointer on error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the local `socket(2)` syscall (`__sys_socket` \u2192 `__sock_create` \u2192 `inet6_create`), with no remote or network-peer input involved. No packet processing path reaches this function.\nAC:L - The failure path is deterministic, not a race: `socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6)` fails with -EACCES for any user outside the default-empty `ping_group_range`, and can be repeated in a tight loop to spray and reclaim the freed `struct sock` reliably.\nPR:L - Any unprivileged local user can trigger the dangling pointer \u2014 `ping_init_sock()` returning -EACCES is precisely the unprivileged case, and the `BPF_CGROUP_RUN_PROG_INET_SOCK` rejection path applies to ordinary confined services. No capability is needed, and the SOCK_RAW variant is reachable via `unshare -Urn`.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own syscalls; no victim action or interaction is required.\nS:U - The freed object and the corrupted state are both kernel networking structures within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The use-after-free lets an attacker reclaim the freed `struct sock` slab object with controlled data while a live `struct socket` still references it, enabling disclosure of kernel memory \u2014 the upstream KASAN report shows exactly such a UAF read in `__sock_gen_cookie()`.\nI:H - Control over the contents of the reclaimed `struct sock` (including embedded function pointers and `sk_prot`/`sk_destruct` fields) that are later dereferenced through the stale `sock-\u003esk` yields an arbitrary-write / control-flow-hijack primitive, the standard outcome for a kernel UAF on a sprayable slab object.\nA:H - Dereferencing the freed socket causes a kernel oops or panic, and the trigger is repeatable at will by an unprivileged user, making it a reliable local denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:20.668Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2709d1271cfdf55c670ab5c5982139ab627ddc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/35360255ca30776dee34d9fa764cffa24d0a5f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/276a473c956fb55a6f3affa9ff232e10fffa7b43"
        },
        {
          "url": "https://git.kernel.org/stable/c/79e16a0d339532ea832d85798eb036fc4f9e0cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/706b07b7b37f886423846cb38919132090bc40da"
        },
        {
          "url": "https://git.kernel.org/stable/c/f44fceb71d72d29fb00e0ac84cdf9c081b03cd06"
        },
        {
          "url": "https://git.kernel.org/stable/c/9df99c395d0f55fb444ef39f4d6f194ca437d884"
        }
      ],
      "title": "net: inet6: do not leave a dangling sk pointer in inet6_create()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56600",
    "datePublished": "2024-12-27T14:51:06.610Z",
    "dateReserved": "2024-12-27T14:03:06.011Z",
    "dateUpdated": "2026-08-05T11:45:20.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2025:1232-1

CVE-2024-41090 (GCVE-0-2024-41090)

CVE-2024-56600 (GCVE-0-2024-56600)

Tags

Sightings

Nomenclature

Related by attack behaviour