CVE-2024-56603

net: af_can: do not leave a dangling sk pointer in can_create()

HIGH

7.8

CVSS Score

Published: December 27, 2024 at 02:51 PM UTC

Updated: August 5, 2026 at 12:05 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 5.4.2872.6.25 ≤ v < 5.10.2312.6.25 ≤ v < 5.15.1742.6.25 ≤ v < 5.4.2872.6.25 ≤ v < 6.1.1202.6.25 ≤ v < 6.12.52.6.25 ≤ v < 6.132.6.25 ≤ v < 6.6.665.11 ≤ v < 5.15.1745.16 ≤ v < 6.1.1205.5 ≤ v < 5.10.2316.2 ≤ v < 6.6.666.7 ≤ v < 6.12.50d66548a10cbbe0ef256852d63d30603f0f73f9b2.6.25

Vendor states this is fixed in 1fe625f12d090d69f3f084990c7e4c1ff94bfe5f (fixed)

Vendor states this is fixed in 5947c9ac08f0771ea8ed64186b0d52e9029cb6c0 (fixed)

Vendor states this is fixed in 811a7ca7320c062e15d0f5b171fe6ad8592d1434 (fixed)

Vendor states this is fixed in 884ae8bcee749be43a071d6ed2d89058dbd2425c (fixed)

Vendor states this is fixed in 8df832e6b945e1ba61467d7f1c9305e314ae92fe (fixed)

Vendor states this is fixed in ce39b5576785bb3e66591145aad03d66bc3e778d (fixed)

Vendor states this is fixed in db207d19adbac96058685f6257720906ad41d215 (fixed)

Vendor states this is fixed in 2.6.25 (unaffected)

Vendor states this is fixed in 5.10.231 (unaffected)

Vendor states this is fixed in 5.15.174 (unaffected)

Vendor states this is fixed in 5.4.287 (unaffected)

Vendor states this is fixed in 6.1.120 (unaffected)