CVE-2024-56783

netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

State: Published
Severity: 5.5 Medium
Published: Jan 8, 2025
Updated: May 23, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable value not to harm performance. Remove unnecessary WARN_ON_ONCE which is reachable from userspace.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-617 Reachable Assertion

Affected Products

Product	Versions
LinuxLinux	ace0db36b4a1db07a48517c4f04488d1cd05e5f5 to before 7064a6daa4a700a298fe3aee11dea296bfe59fc4Affected f07e28e4c623168f9fa5c00f518bd341d4014aa6 to before 2f9bec0a749eb646b384fde0c7b7c24687b2ffaeAffected 7f3287db654395f9c5ddd246325ff7889f550286 to before e227c042580ab065edc610c9ddc9bea691e6fc4dAffected 7f3287db654395f9c5ddd246325ff7889f550286 to before b7529880cb961d515642ce63f9d7570869bbbdc3Affected ecc5368315af8473fe052cb928e53756dbfe4403Affected 6.1.112 to before 6.1.120Affected 6.6.53 to before 6.6.66Affected 6.10.12 to before 6.11Affected
LinuxLinux	6.11Affected before 6.11Not affected 6.1.120 through 6.1.Not affected 6.6.66 through 6.6.Not affected 6.12.5 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

ace0db36b4a1db07a48517c4f04488d1cd05e5f5 to before 7064a6daa4a700a298fe3aee11dea296bfe59fc4Affected
f07e28e4c623168f9fa5c00f518bd341d4014aa6 to before 2f9bec0a749eb646b384fde0c7b7c24687b2ffaeAffected
7f3287db654395f9c5ddd246325ff7889f550286 to before e227c042580ab065edc610c9ddc9bea691e6fc4dAffected
7f3287db654395f9c5ddd246325ff7889f550286 to before b7529880cb961d515642ce63f9d7570869bbbdc3Affected
ecc5368315af8473fe052cb928e53756dbfe4403Affected
6.1.112 to before 6.1.120Affected
6.6.53 to before 6.6.66Affected
6.10.12 to before 6.11Affected

LinuxLinux

6.11Affected
before 6.11Not affected
6.1.120 through 6.1.*Not affected
6.6.66 through 6.6.*Not affected
6.12.5 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.