CVE-2024-56664 (GCVE-0-2024-56664)
Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
EPSS
VEX
Title
bpf, sockmap: Fix race between element replace and close()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix race between element replace and close()
Element replace (with a socket different from the one stored) may race
with socket's close() link popping & unlinking. __sock_map_delete()
unconditionally unrefs the (wrong) element:
// set map[0] = s0
map_update_elem(map, 0, s0)
// drop fd of s0
close(s0)
sock_map_close()
lock_sock(sk) (s0!)
sock_map_remove_links(sk)
link = sk_psock_link_pop()
sock_map_unlink(sk, link)
sock_map_delete_from_link
// replace map[0] with s1
map_update_elem(map, 0, s1)
sock_map_update_elem
(s1!) lock_sock(sk)
sock_map_update_common
psock = sk_psock(sk)
spin_lock(&stab->lock)
osk = stab->sks[idx]
sock_map_add_link(..., &stab->sks[idx])
sock_map_unref(osk, &stab->sks[idx])
psock = sk_psock(osk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test(&psock))
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
unlock_sock(sk)
__sock_map_delete
spin_lock(&stab->lock)
sk = *psk // s1 replaced s0; sk == s1
if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch
sk = xchg(psk, NULL)
if (sk)
sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle
psock = sk_psock(sk)
sk_psock_put(sk, psock)
if (refcount_dec_and_test())
sk_psock_drop(sk, psock)
spin_unlock(&stab->lock)
release_sock(sk)
Then close(map) enqueues bpf_map_free_deferred, which finally calls
sock_map_free(). This results in some refcount_t warnings along with
a KASAN splat [1].
Fix __sock_map_delete(), do not allow sock_map_unref() on elements that
may have been replaced.
[1]:
BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330
Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063
CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
Workqueue: events_unbound bpf_map_free_deferred
Call Trace:
<TASK>
dump_stack_lvl+0x68/0x90
print_report+0x174/0x4f6
kasan_report+0xb9/0x190
kasan_check_range+0x10f/0x1e0
sock_map_free+0x10e/0x330
bpf_map_free_deferred+0x173/0x320
process_one_work+0x846/0x1420
worker_thread+0x5b3/0xf80
kthread+0x29e/0x360
ret_from_fork+0x2d/0x70
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 1202:
kasan_save_stack+0x1e/0x40
kasan_save_track+0x10/0x30
__kasan_slab_alloc+0x85/0x90
kmem_cache_alloc_noprof+0x131/0x450
sk_prot_alloc+0x5b/0x220
sk_alloc+0x2c/0x870
unix_create1+0x88/0x8a0
unix_create+0xc5/0x180
__sock_create+0x241/0x650
__sys_socketpair+0x1ce/0x420
__x64_sys_socketpair+0x92/0x100
do_syscall_64+0x93/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 46:
kasan_save_stack+0x1e/0x40
kasan_save_track+0x10/0x30
kasan_save_free_info+0x37/0x60
__kasan_slab_free+0x4b/0x70
kmem_cache_free+0x1a1/0x590
__sk_destruct+0x388/0x5a0
sk_psock_destroy+0x73e/0xa50
process_one_work+0x846/0x1420
worker_thread+0x5b3/0xf80
kthread+0x29e/0x360
ret_from_fork+0x2d/0x70
ret_from_fork_asm+0x1a/0x30
The bu
---truncated---
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
604326b41a6fb9b4a78b6179335decee0365cd8c , < 6deb9e85dc9a2ba4414b91c1b5b00b8415910890
(git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < fdb2cd8957ac51f84c9e742ba866087944bb834b (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < b79a0d1e9a374d1b376933a354c4fcd01fce0365 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < b015f19fedd2e12283a8450dd0aefce49ec57015 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < bf2318e288f636a882eea39f7e1015623629f168 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < ed1fc5d76b81a4d681211333c026202cad4d5649 (git) |
guessed | |
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.236 , ≤ 5.10.* (semver) Unaffected: 5.15.180 , ≤ 5.15.* (semver) Unaffected: 6.1.125 , ≤ 6.1.* (semver) Unaffected: 6.6.67 , ≤ 6.6.* (semver) Unaffected: 6.12.6 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:52:13.123Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/sock_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6deb9e85dc9a2ba4414b91c1b5b00b8415910890",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "fdb2cd8957ac51f84c9e742ba866087944bb834b",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "b79a0d1e9a374d1b376933a354c4fcd01fce0365",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "b015f19fedd2e12283a8450dd0aefce49ec57015",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "bf2318e288f636a882eea39f7e1015623629f168",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "ed1fc5d76b81a4d681211333c026202cad4d5649",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/sock_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.236",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.125",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.67",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.236",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.180",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.125",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.67",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.6",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix race between element replace and close()\n\nElement replace (with a socket different from the one stored) may race\nwith socket\u0027s close() link popping \u0026 unlinking. __sock_map_delete()\nunconditionally unrefs the (wrong) element:\n\n// set map[0] = s0\nmap_update_elem(map, 0, s0)\n\n// drop fd of s0\nclose(s0)\n sock_map_close()\n lock_sock(sk) (s0!)\n sock_map_remove_links(sk)\n link = sk_psock_link_pop()\n sock_map_unlink(sk, link)\n sock_map_delete_from_link\n // replace map[0] with s1\n map_update_elem(map, 0, s1)\n sock_map_update_elem\n (s1!) lock_sock(sk)\n sock_map_update_common\n psock = sk_psock(sk)\n spin_lock(\u0026stab-\u003elock)\n osk = stab-\u003esks[idx]\n sock_map_add_link(..., \u0026stab-\u003esks[idx])\n sock_map_unref(osk, \u0026stab-\u003esks[idx])\n psock = sk_psock(osk)\n sk_psock_put(sk, psock)\n if (refcount_dec_and_test(\u0026psock))\n sk_psock_drop(sk, psock)\n spin_unlock(\u0026stab-\u003elock)\n unlock_sock(sk)\n __sock_map_delete\n spin_lock(\u0026stab-\u003elock)\n sk = *psk // s1 replaced s0; sk == s1\n if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch\n sk = xchg(psk, NULL)\n if (sk)\n sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle\n psock = sk_psock(sk)\n sk_psock_put(sk, psock)\n if (refcount_dec_and_test())\n sk_psock_drop(sk, psock)\n spin_unlock(\u0026stab-\u003elock)\n release_sock(sk)\n\nThen close(map) enqueues bpf_map_free_deferred, which finally calls\nsock_map_free(). This results in some refcount_t warnings along with\na KASAN splat [1].\n\nFix __sock_map_delete(), do not allow sock_map_unref() on elements that\nmay have been replaced.\n\n[1]:\nBUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330\nWrite of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063\n\nCPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\nWorkqueue: events_unbound bpf_map_free_deferred\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n kasan_check_range+0x10f/0x1e0\n sock_map_free+0x10e/0x330\n bpf_map_free_deferred+0x173/0x320\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 1202:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n unix_create1+0x88/0x8a0\n unix_create+0xc5/0x180\n __sock_create+0x241/0x650\n __sys_socketpair+0x1ce/0x420\n __x64_sys_socketpair+0x92/0x100\n do_syscall_64+0x93/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 46:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n sk_psock_destroy+0x73e/0xa50\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n\nThe bu\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Both halves of the race are local syscalls \u2014 `bpf(BPF_MAP_UPDATE_ELEM)` on a sockmap fd and `close()` on a sockmap\u0027d socket \u2014 with no remote peer data involved in reaching `__sock_map_delete()`. Sockmap element replace and socket teardown are driven entirely from the local host.\nAC:L - The attacker controls both sides of the race, running one thread looping `close()` on sockmap\u0027d sockets and another looping `map_update_elem()` to replace the same index, so the window is created and retried by the attacker rather than depending on any external condition. Nothing about the race depends on victim state or memory layout the attacker cannot influence, and the reporter reproduced it with a KASAN splat.\nPR:L - Creating the sockmap requires `CAP_NET_ADMIN`, but `bpf_token_capable()` grants it at `ns_capable()` level inside a user namespace via delegated BPF tokens, and `CAP_NET_ADMIN` is routinely handed to container and network-agent workloads. Once the map fd exists, `map_update_elem()` and `close()` need no further privilege, so an ordinary unprivileged-in-init-ns user reaches this path.\nUI:N - The attacker creates the sockmap, inserts its own sockets, and drives both racing threads entirely on its own. No victim action \u2014 no mount, no file open, no third-party interaction \u2014 is required.\nS:U - The refcount underflow, premature `sk_psock_drop()`, and resulting use-after-free are all confined to kernel memory and the socket/psock state managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stray `sock_map_unref()` frees the `struct sock` while `stab-\u003esks[idx]` retains a dangling pointer, letting the attacker reclaim the freed slab object with controlled data and then read it back through `sock_map_lookup_sys()`/`__sock_gen_cookie()` or a `bpf_sk_redirect_map()` datapath dereference. A use-after-free on a `struct sock` exposes its `sk_prot`, callbacks, and adjacent heap contents, giving an arbitrary-read primitive.\nI:H - `sock_map_free()` performs a 4-byte use-after-free *write* into the freed socket (the KASAN splat) and `lock_sock()` on freed memory, while the torn link means the map keeps referencing a destroyed socket whose `sk_prot` function pointers are dereferenced on later redirect/lookup. Combined with the attacker-chosen reclaim window on the 1984-byte slab, this is a heap write and control-flow hijack primitive, not a bounded corruption.\nA:H - The bug produces `refcount_t` addition-on-zero and underflow warnings plus a KASAN slab-use-after-free in `sock_map_free()`, and the freed socket is later locked and dereferenced from a workqueue \u2014 with panic_on_warn or panic_on_oops this is an immediate kernel panic, and otherwise an oops in `bpf_map_free_deferred`. The attacker can retrigger it at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:45:58.455Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6deb9e85dc9a2ba4414b91c1b5b00b8415910890"
},
{
"url": "https://git.kernel.org/stable/c/fdb2cd8957ac51f84c9e742ba866087944bb834b"
},
{
"url": "https://git.kernel.org/stable/c/b79a0d1e9a374d1b376933a354c4fcd01fce0365"
},
{
"url": "https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015"
},
{
"url": "https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168"
},
{
"url": "https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649"
}
],
"title": "bpf, sockmap: Fix race between element replace and close()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-56664",
"datePublished": "2024-12-27T15:06:26.276Z",
"dateReserved": "2024-12-27T15:00:39.844Z",
"dateUpdated": "2026-08-05T11:45:58.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-56664",
"date": "2026-09-15",
"epss": "0.0018",
"percentile": "0.07726"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"6.6.67\", \"matchCriteriaId\": \"54ED2956-6164-49A7-8D04-741D1A16289C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.6\", \"matchCriteriaId\": \"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Fix race between element replace and close()\\n\\nElement replace (with a socket different from the one stored) may race\\nwith socket\u0027s close() link popping \u0026 unlinking. __sock_map_delete()\\nunconditionally unrefs the (wrong) element:\\n\\n// set map[0] = s0\\nmap_update_elem(map, 0, s0)\\n\\n// drop fd of s0\\nclose(s0)\\n sock_map_close()\\n lock_sock(sk) (s0!)\\n sock_map_remove_links(sk)\\n link = sk_psock_link_pop()\\n sock_map_unlink(sk, link)\\n sock_map_delete_from_link\\n // replace map[0] with s1\\n map_update_elem(map, 0, s1)\\n sock_map_update_elem\\n (s1!) lock_sock(sk)\\n sock_map_update_common\\n psock = sk_psock(sk)\\n spin_lock(\u0026stab-\u003elock)\\n osk = stab-\u003esks[idx]\\n sock_map_add_link(..., \u0026stab-\u003esks[idx])\\n sock_map_unref(osk, \u0026stab-\u003esks[idx])\\n psock = sk_psock(osk)\\n sk_psock_put(sk, psock)\\n if (refcount_dec_and_test(\u0026psock))\\n sk_psock_drop(sk, psock)\\n spin_unlock(\u0026stab-\u003elock)\\n unlock_sock(sk)\\n __sock_map_delete\\n spin_lock(\u0026stab-\u003elock)\\n sk = *psk // s1 replaced s0; sk == s1\\n if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch\\n sk = xchg(psk, NULL)\\n if (sk)\\n sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle\\n psock = sk_psock(sk)\\n sk_psock_put(sk, psock)\\n if (refcount_dec_and_test())\\n sk_psock_drop(sk, psock)\\n spin_unlock(\u0026stab-\u003elock)\\n release_sock(sk)\\n\\nThen close(map) enqueues bpf_map_free_deferred, which finally calls\\nsock_map_free(). This results in some refcount_t warnings along with\\na KASAN splat [1].\\n\\nFix __sock_map_delete(), do not allow sock_map_unref() on elements that\\nmay have been replaced.\\n\\n[1]:\\nBUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330\\nWrite of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063\\n\\nCPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\\nWorkqueue: events_unbound bpf_map_free_deferred\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x68/0x90\\n print_report+0x174/0x4f6\\n kasan_report+0xb9/0x190\\n kasan_check_range+0x10f/0x1e0\\n sock_map_free+0x10e/0x330\\n bpf_map_free_deferred+0x173/0x320\\n process_one_work+0x846/0x1420\\n worker_thread+0x5b3/0xf80\\n kthread+0x29e/0x360\\n ret_from_fork+0x2d/0x70\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 1202:\\n kasan_save_stack+0x1e/0x40\\n kasan_save_track+0x10/0x30\\n __kasan_slab_alloc+0x85/0x90\\n kmem_cache_alloc_noprof+0x131/0x450\\n sk_prot_alloc+0x5b/0x220\\n sk_alloc+0x2c/0x870\\n unix_create1+0x88/0x8a0\\n unix_create+0xc5/0x180\\n __sock_create+0x241/0x650\\n __sys_socketpair+0x1ce/0x420\\n __x64_sys_socketpair+0x92/0x100\\n do_syscall_64+0x93/0x180\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nFreed by task 46:\\n kasan_save_stack+0x1e/0x40\\n kasan_save_track+0x10/0x30\\n kasan_save_free_info+0x37/0x60\\n __kasan_slab_free+0x4b/0x70\\n kmem_cache_free+0x1a1/0x590\\n __sk_destruct+0x388/0x5a0\\n sk_psock_destroy+0x73e/0xa50\\n process_one_work+0x846/0x1420\\n worker_thread+0x5b3/0xf80\\n kthread+0x29e/0x360\\n ret_from_fork+0x2d/0x70\\n ret_from_fork_asm+0x1a/0x30\\n\\nThe bu\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Se corrige la competencia entre el reemplazo de elementos y close(). El reemplazo de elementos (con un socket diferente del almacenado) puede competir con el enlace de close() del socket, haciendo estallar y desvinculando el enlace. __sock_map_delete() anula la referencia incondicional del elemento (incorrecto): // establece map[0] = s0 map_update_elem(map, 0, s0) // elimina fd de s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // reemplaza map[0] con s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(\u0026amp;stab-\u0026gt;lock) osk = stab-\u0026gt;sks[idx] sock_map_add_link(..., \u0026amp;stab-\u0026gt;sks[idx]) sock_map_unref(osk, \u0026amp;stab-\u0026gt;sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) si (conteo_de_referencias_y_pruebas(\u0026amp;psock)) sk_psock_drop(sk, psock) desbloqueo_spin(\u0026amp;stab-\u0026gt;bloqueo) desbloqueo_sock(sk) __sock_map_delete bloqueo_spin(\u0026amp;stab-\u0026gt;bloqueo) sk = *psk // s1 reemplaz\\u00f3 a s0; sk == s1 si (!sk_prueba || sk_prueba == sk) // sk_prueba (s0) != sk (s1); sin rama sk = xchg(psk, NULL) si (sk) sock_map_unref(sk, psk) // desreferenciar s1; sks[idx] dejar\\u00e1 colgado psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(\u0026amp;stab-\u0026gt;lock) release_sock(sk) Luego close(map) pone en cola bpf_map_free_deferred, que finalmente llama a sock_map_free(). Esto da como resultado algunas advertencias refcount_t junto con un splat KASAN [1]. Corrija __sock_map_delete(), no permita sock_map_unref() en elementos que pueden haber sido reemplazados. [1]: ERROR: KASAN: slab-use-after-free en sock_map_free+0x10e/0x330 Escritura de tama\\u00f1o 4 en la direcci\\u00f3n ffff88811f5b9100 por la tarea kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 No contaminado 6.12.0+ #125 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Cola de trabajo: events_unbound bpf_map_free_deferred Rastreo de llamadas: dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 Asignado por la tarea 1202: pila de guardado kasan+0x1e/0x40 seguimiento de guardado kasan+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 La librer\\u00eda ---truncada---\"}]",
"id": "CVE-2024-56664",
"lastModified": "2025-01-06T19:25:18.827",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
"published": "2024-12-27T15:15:26.297",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}, {\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
},
"microsoft_vex": {
"current_release_date": "2026-02-19T01:40:07.000Z",
"cve": "CVE-2024-56664",
"id": "msrc_CVE-2024-56664",
"initial_release_date": "2024-12-02T00:00:00.000Z",
"product_status:fixed": "5",
"product_status:known_affected": "5",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "bpf, sockmap: Fix race between element replace and close()",
"url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56664.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-56664\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:26.297\",\"lastModified\":\"2026-08-04T11:22:20.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Fix race between element replace and close()\\n\\nElement replace (with a socket different from the one stored) may race\\nwith socket\u0027s close() link popping \u0026 unlinking. __sock_map_delete()\\nunconditionally unrefs the (wrong) element:\\n\\n// set map[0] = s0\\nmap_update_elem(map, 0, s0)\\n\\n// drop fd of s0\\nclose(s0)\\n sock_map_close()\\n lock_sock(sk) (s0!)\\n sock_map_remove_links(sk)\\n link = sk_psock_link_pop()\\n sock_map_unlink(sk, link)\\n sock_map_delete_from_link\\n // replace map[0] with s1\\n map_update_elem(map, 0, s1)\\n sock_map_update_elem\\n (s1!) lock_sock(sk)\\n sock_map_update_common\\n psock = sk_psock(sk)\\n spin_lock(\u0026stab-\u003elock)\\n osk = stab-\u003esks[idx]\\n sock_map_add_link(..., \u0026stab-\u003esks[idx])\\n sock_map_unref(osk, \u0026stab-\u003esks[idx])\\n psock = sk_psock(osk)\\n sk_psock_put(sk, psock)\\n if (refcount_dec_and_test(\u0026psock))\\n sk_psock_drop(sk, psock)\\n spin_unlock(\u0026stab-\u003elock)\\n unlock_sock(sk)\\n __sock_map_delete\\n spin_lock(\u0026stab-\u003elock)\\n sk = *psk // s1 replaced s0; sk == s1\\n if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch\\n sk = xchg(psk, NULL)\\n if (sk)\\n sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle\\n psock = sk_psock(sk)\\n sk_psock_put(sk, psock)\\n if (refcount_dec_and_test())\\n sk_psock_drop(sk, psock)\\n spin_unlock(\u0026stab-\u003elock)\\n release_sock(sk)\\n\\nThen close(map) enqueues bpf_map_free_deferred, which finally calls\\nsock_map_free(). This results in some refcount_t warnings along with\\na KASAN splat [1].\\n\\nFix __sock_map_delete(), do not allow sock_map_unref() on elements that\\nmay have been replaced.\\n\\n[1]:\\nBUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330\\nWrite of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063\\n\\nCPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\\nWorkqueue: events_unbound bpf_map_free_deferred\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x68/0x90\\n print_report+0x174/0x4f6\\n kasan_report+0xb9/0x190\\n kasan_check_range+0x10f/0x1e0\\n sock_map_free+0x10e/0x330\\n bpf_map_free_deferred+0x173/0x320\\n process_one_work+0x846/0x1420\\n worker_thread+0x5b3/0xf80\\n kthread+0x29e/0x360\\n ret_from_fork+0x2d/0x70\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 1202:\\n kasan_save_stack+0x1e/0x40\\n kasan_save_track+0x10/0x30\\n __kasan_slab_alloc+0x85/0x90\\n kmem_cache_alloc_noprof+0x131/0x450\\n sk_prot_alloc+0x5b/0x220\\n sk_alloc+0x2c/0x870\\n unix_create1+0x88/0x8a0\\n unix_create+0xc5/0x180\\n __sock_create+0x241/0x650\\n __sys_socketpair+0x1ce/0x420\\n __x64_sys_socketpair+0x92/0x100\\n do_syscall_64+0x93/0x180\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nFreed by task 46:\\n kasan_save_stack+0x1e/0x40\\n kasan_save_track+0x10/0x30\\n kasan_save_free_info+0x37/0x60\\n __kasan_slab_free+0x4b/0x70\\n kmem_cache_free+0x1a1/0x590\\n __sk_destruct+0x388/0x5a0\\n sk_psock_destroy+0x73e/0xa50\\n process_one_work+0x846/0x1420\\n worker_thread+0x5b3/0xf80\\n kthread+0x29e/0x360\\n ret_from_fork+0x2d/0x70\\n ret_from_fork_asm+0x1a/0x30\\n\\nThe bu\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Se corrige la competencia entre el reemplazo de elementos y close(). El reemplazo de elementos (con un socket diferente del almacenado) puede competir con el enlace de close() del socket, haciendo estallar y desvinculando el enlace. __sock_map_delete() anula la referencia incondicional del elemento (incorrecto): // establece map[0] = s0 map_update_elem(map, 0, s0) // elimina fd de s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // reemplaza map[0] con s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(\u0026amp;stab-\u0026gt;lock) osk = stab-\u0026gt;sks[idx] sock_map_add_link(..., \u0026amp;stab-\u0026gt;sks[idx]) sock_map_unref(osk, \u0026amp;stab-\u0026gt;sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) si (conteo_de_referencias_y_pruebas(\u0026amp;psock)) sk_psock_drop(sk, psock) desbloqueo_spin(\u0026amp;stab-\u0026gt;bloqueo) desbloqueo_sock(sk) __sock_map_delete bloqueo_spin(\u0026amp;stab-\u0026gt;bloqueo) sk = *psk // s1 reemplaz\u00f3 a s0; sk == s1 si (!sk_prueba || sk_prueba == sk) // sk_prueba (s0) != sk (s1); sin rama sk = xchg(psk, NULL) si (sk) sock_map_unref(sk, psk) // desreferenciar s1; sks[idx] dejar\u00e1 colgado psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(\u0026amp;stab-\u0026gt;lock) release_sock(sk) Luego close(map) pone en cola bpf_map_free_deferred, que finalmente llama a sock_map_free(). Esto da como resultado algunas advertencias refcount_t junto con un splat KASAN [1]. Corrija __sock_map_delete(), no permita sock_map_unref() en elementos que pueden haber sido reemplazados. [1]: ERROR: KASAN: slab-use-after-free en sock_map_free+0x10e/0x330 Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff88811f5b9100 por la tarea kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 No contaminado 6.12.0+ #125 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Cola de trabajo: events_unbound bpf_map_free_deferred Rastreo de llamadas: dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 Asignado por la tarea 1202: pila de guardado kasan+0x1e/0x40 seguimiento de guardado kasan+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 La librer\u00eda ---truncada---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/sock_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"6deb9e85dc9a2ba4414b91c1b5b00b8415910890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"fdb2cd8957ac51f84c9e742ba866087944bb834b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"b79a0d1e9a374d1b376933a354c4fcd01fce0365\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"b015f19fedd2e12283a8450dd0aefce49ec57015\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"bf2318e288f636a882eea39f7e1015623629f168\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"ed1fc5d76b81a4d681211333c026202cad4d5649\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/sock_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.236\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.180\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.125\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.67\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"54ED2956-6164-49A7-8D04-741D1A16289C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6deb9e85dc9a2ba4414b91c1b5b00b8415910890\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79a0d1e9a374d1b376933a354c4fcd01fce0365\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fdb2cd8957ac51f84c9e742ba866087944bb834b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T14:03:11+00:00",
"cve": "CVE-2024-56664",
"id": "CVE-2024-56664",
"initial_release_date": "2024-12-27T00:00:00+00:00",
"product_status:fixed": "305",
"product_status:known_affected": "70",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bpf, sockmap: Fix race between element replace and close()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56664.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-16T00:20:54Z",
"cve": "CVE-2024-56664",
"id": "CVE-2024-56664",
"initial_release_date": "2025-01-10T00:21:24Z",
"product_status:known_affected": "485",
"product_status:known_not_affected": "134",
"product_status:recommended": "796",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-56664",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56664.json",
"version": "97"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…