Read the docs
TI-2024-37546 Aliases CVE-2024-56661GHSA-4g6f-5r4h-c449

tipc: fix NULL deref in cleanup_bearer()

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-476.

Summary

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit, ub->ubsock->sk was NULL when attempting the atomic_dec() : atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); Fix this by caching the tipc_net pointer. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events cleanup_bearer RIP: 0010:read_pnet include/net/net_namespace.h:387 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:cleanup_bearer+0x1f7/0x280 net/tipc/udp_media.c:820 Code: 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 3c f7 99 f6 48 8b 1b 48 83 c3 30 e8 f0 e4 60 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 1a f7 99 f6 49 83 c7 e8 48 8b 1b RSP: 0018:ffffc9000410fb70 EFLAGS: 00010206 RAX: 0000000000000006 RBX: 0000000000000030 RCX: ffff88802fe45a00 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc9000410f900 RBP: ffff88807e1f0908 R08: ffffc9000410f907 R09: 1ffff92000821f20 R10: dffffc0000000000 R11: fffff52000821f21 R12: ffff888031d19980 R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88807e1f0918 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556ca050b000 CR3: 0000000031c0c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 5.4.288, 5.10.232, 5.15.175 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.4.287 to before 5.4.288; 5.10.231 to before 5.10.232; 5.15.174 to before 5.15.175; 6.1.120 to before 6.1.121; 6.6.66 to before 6.6.67; 6.12.5 to before 6.12.65.4.288, 5.10.232, 5.15.175, 6.1.121, 6.6.67, 6.12.6Patch availableCNA
  • Linux VendorLinux Affected 5.4.287 to before 5.4.288; 5.10.231 to before 5.10.232; 5.15.174 to before 5.15.175; 6.1.120 to before 6.1.121; 6.6.66 to before 6.6.67; 6.12.5 to before 6.12.6 Fixed in 5.4.288, 5.10.232, 5.15.175, 6.1.121, 6.6.67, 6.12.6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:5.4.287:*:*:*:*:*:*:*5.4.287VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.10.231:*:*:*:*:*:*:*5.10.231VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.15.174:*:*:*:*:*:*:*5.15.174VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.1.120:*:*:*:*:*:*:*6.1.120VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.6.66:*:*:*:*:*:*:*6.6.66VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12.5:*:*:*:*:*:*:*6.12.5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*6.13 rc2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:5.4.287:*:*:*:*:*:*:* Versions 5.4.287 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.10.231:*:*:*:*:*:*:* Versions 5.10.231 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.15.174:*:*:*:*:*:*:* Versions 5.15.174 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.1.120:*:*:*:*:*:*:* Versions 6.1.120 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.6.66:*:*:*:*:*:*:* Versions 6.6.66 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12.5:*:*:*:*:*:*:* Versions 6.12.5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* Versions 6.13 rc2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.4.288, 5.10.232, 5.15.175, 6.1.121, 6.6.67, 6.12.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-56661
  2. 2026-10-03 Alias added: GHSA-4g6f-5r4h-c449

References

Patch 7

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences