CVE-2024-50264

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

HIGH

7.8

CVSS Score

Published: November 19, 2024 at 01:29 AM UTC

Updated: August 5, 2026 at 12:05 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.20 ≤ v < 5.4.2864.8 ≤ v < 4.19.3244.8 ≤ v < 5.10.2304.8 ≤ v < 5.15.1724.8 ≤ v < 5.4.2864.8 ≤ v < 6.1.1174.8 ≤ v < 6.11.84.8 ≤ v < 6.124.8 ≤ v < 6.6.615.11 ≤ v < 5.15.1725.16 ≤ v < 6.1.1175.5 ≤ v < 5.10.2306.2 ≤ v < 6.6.616.7 ≤ v < 6.11.86.12 rc1 6.12 rc2 6.12 rc3 6.12 rc4 6.12 rc5 6.12 rc66a8fc78367d70720af960dcecec917d3ae5f3b

Vendor states this is fixed in 2a6a4e69f255b7aed17f93995691ab4f0d3c2203 (fixed)

Vendor states this is fixed in 44d29897eafd0e1196453d3003a4d5e0b968eeab (fixed)

Vendor states this is fixed in 5f092a4271f6dccf88fe0d132475a17b69ef71df (fixed)

Vendor states this is fixed in 5f970935d09934222fdef3d0e20c648ea7a963c1 (fixed)

Vendor states this is fixed in 6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f (fixed)

Vendor states this is fixed in b110196fec44fe966952004bd426967c2a8fd358 (fixed)

Vendor states this is fixed in eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1 (fixed)

Vendor states this is fixed in fd8ae346692a56b4437d626c5460c7104980f389 (fixed)

Vendor states this is fixed in 4.19.324 (unaffected)

Vendor states this is fixed in 4.8 (unaffected)

Vendor states this is fixed in 5.10.230 (unaffected)

Vendor states this is fixed in 5.15.172 (unaffected)

Vendor states this is fixed in 5.4.286 (unaffected)

Vendor states this is fixed in 6.1.117 (unaffected)

Vendor states this is fixed in 6.11.8 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.6.61 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references