CVE-2024-50186

In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socket creation fails"). The problem is that commit did not fully address the problem, as some pf->create implementations do not use sk_common_release in their error paths. For example, we can use the same reproducer as in the above commit, but changing ping to arping. arping uses AF_PACKET socket and if packet_create fails, it will just sk_free the allocated sk object. While we could chase all the pf->create implementations and make sure they NULL the freed sk object on error from the socket, we can't guarantee future protocols will not make the same mistake. So it is easier to just explicitly NULL the sk pointer upon return from pf->create in __sock_create. We do know that pf->create always releases the allocated sk object on error, so if the pointer is not NULL, it is definitely dangling.

• CWE-416
• CWE-416

• https://git.kernel.org/stable/c/563e6892e21d6ecabdf62103fc4e7b326d212334Patch
• https://git.kernel.org/stable/c/631083143315d1b192bd7d915b967b37819e88eaPatch
• https://git.kernel.org/stable/c/8e1b72fd74bf9da3b099d09857f4e7f114f38e12Patch
• https://git.kernel.org/stable/c/b7d22a79ff4e962b8af5ffe623abd1d6c179eb9fPatch
• https://git.kernel.org/stable/c/daf462ff3cde6ecf22b98d9ae770232c10d28de2Patch
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Published

Nov 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50180In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-50181Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-50182In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50183In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-50184In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50185In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50187In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50188In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50189In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-5019In WhatsUp Gold versions released before 2023.1.3,  an unau…7.5
• CVE-2024-50190In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-50191In the Linux kernel, the following vulnerability has been re…5.5