CVE-2024-50264

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

State: Published
Severity: 7.8 High
Published: Nov 19, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	06a8fc78367d070720af960dcecec917d3ae5f3b to before 5f092a4271f6dccf88fe0d132475a17b69ef71dfAffected 06a8fc78367d070720af960dcecec917d3ae5f3b to before fd8ae346692a56b4437d626c5460c7104980f389Affected 06a8fc78367d070720af960dcecec917d3ae5f3b to before eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1Affected 06a8fc78367d070720af960dcecec917d3ae5f3b to before 2a6a4e69f255b7aed17f93995691ab4f0d3c2203Affected 06a8fc78367d070720af960dcecec917d3ae5f3b to before 44d29897eafd0e1196453d3003a4d5e0b968eeabAffected 06a8fc78367d070720af960dcecec917d3ae5f3b to before b110196fec44fe966952004bd426967c2a8fd358Affected 06a8fc78367d070720af960dcecec917d3ae5f3b to before 5f970935d09934222fdef3d0e20c648ea7a963c1Affected 06a8fc78367d070720af960dcecec917d3ae5f3b to before 6ca575374dd9a507cdd16dfa0e78c2e9e20bd05fAffected
LinuxLinux	4.8Affected before 4.8Not affected 4.19.324 through 4.19.Not affected 5.4.286 through 5.4.Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

06a8fc78367d070720af960dcecec917d3ae5f3b to before 5f092a4271f6dccf88fe0d132475a17b69ef71dfAffected
06a8fc78367d070720af960dcecec917d3ae5f3b to before fd8ae346692a56b4437d626c5460c7104980f389Affected
06a8fc78367d070720af960dcecec917d3ae5f3b to before eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1Affected
06a8fc78367d070720af960dcecec917d3ae5f3b to before 2a6a4e69f255b7aed17f93995691ab4f0d3c2203Affected
06a8fc78367d070720af960dcecec917d3ae5f3b to before 44d29897eafd0e1196453d3003a4d5e0b968eeabAffected
06a8fc78367d070720af960dcecec917d3ae5f3b to before b110196fec44fe966952004bd426967c2a8fd358Affected
06a8fc78367d070720af960dcecec917d3ae5f3b to before 5f970935d09934222fdef3d0e20c648ea7a963c1Affected
06a8fc78367d070720af960dcecec917d3ae5f3b to before 6ca575374dd9a507cdd16dfa0e78c2e9e20bd05fAffected

LinuxLinux

4.8Affected
before 4.8Not affected
4.19.324 through 4.19.*Not affected
5.4.286 through 5.4.*Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.