CVE-2024-50260

sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()

State
Published
Severity
4.7 Medium
Published
Nov 9, 2024
Updated
May 11, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()

The following race condition could trigger a NULL pointer dereference:

sock_map_link_detach(): sock_map_link_update_prog(): mutex_lock(&sockmap_mutex); ... sockmap_link->map = NULL; mutex_unlock(&sockmap_mutex); mutex_lock(&sockmap_mutex); ... sock_map_prog_link_lookup(sockmap_link->map); mutex_unlock(&sockmap_mutex); <continue>

Fix it by adding a NULL pointer check. In this specific case, it makes no sense to update a link which is being released.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 699c23f02c65cbfc3e638f14ce0d70c23a2e1f02 to before 9afe35fdda16e09d5bd3c49a68ba8c680dd678bdAffected
  • 699c23f02c65cbfc3e638f14ce0d70c23a2e1f02 to before 740be3b9a6d73336f8c7d540842d0831dc7a808bAffected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.11.7 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.