In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in ip6finishoutput2()
If skbexpandhead() returns NULL, skb has been freed and associated dst/idev could also have been freed.
We need to hold rcureadlock() to make sure the dst and associated idev are alive.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56efc253196751ece1fc535a5b582be127b0578a",
"target": {
"function": "ip6_finish_output2",
"file": "net/ipv6/ip6_output.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-44986-12298175",
"digest": {
"length": 1890.0,
"function_hash": "49718131387904561023120391849651489642"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56efc253196751ece1fc535a5b582be127b0578a",
"target": {
"file": "net/ipv6/ip6_output.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-44986-145343c5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97905526152581316876487329038857868827",
"123653553621697858308923049385631115521",
"182546476865057967605226512197121560898",
"65694474675897883303721001681094282929",
"72732502892304147641823736729557836370",
"70087406208886077017706713541135687320",
"184383395642671063628825897526171204662",
"209790684962821841804594798697590526594",
"229228336253034589320711983420402904643"
]
},
"signature_type": "Line"
}
]