CVE-2024-50264

Published: Nov 19, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.

Affected (13)

Products: Linux: Linux Kernel

1 product

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 4.20 to 5.4.286
Linux Linux Kernel	From 4.8 to 4.19.324
Linux Linux Kernel	From 5.11 to 5.15.172
Linux Linux Kernel	From 5.16 to 6.1.117
Linux Linux Kernel	From 5.5 to 5.10.230
Linux Linux Kernel	From 6.2 to 6.6.61
Linux Linux Kernel	From 6.7 to 6.11.8
Linux Linux Kernel	Version 6.12 rc1
Linux Linux Kernel	Version 6.12 rc2
Linux Linux Kernel	Version 6.12 rc3
Linux Linux Kernel	Version 6.12 rc4
Linux Linux Kernel	Version 6.12 rc5
Linux Linux Kernel	Version 6.12 rc6

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (11)

https://a13xp0p0v.github.io/2025/09/02/kernel-hack-drill-and-CVE-2024-50264.html

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

https://git.kernel.org/stable/c/2a6a4e69f255b7aed17f93995691ab4f0d3c2203

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/44d29897eafd0e1196453d3003a4d5e0b968eeab

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/5f970935d09934222fdef3d0e20c648ea7a963c1

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

VDB Entry

https://git.kernel.org/stable/c/6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/b110196fec44fe966952004bd426967c2a8fd358

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/fd8ae346692a56b4437d626c5460c7104980f389

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.