CVE-2024-40910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ax25: Fix refcount imbalance on inbound connections

When releasing a socket in ax25_release(), we call netdev_put() to

decrease the refcount on the associated ax.25 device. However, the

execution path for accepting an incoming connection never calls

netdev_hold(). This imbalance leads to refcount errors, and ultimately

to kernel crashes.

A typical call trace for the above situation will start with one of the

following errors:

refcount_t: decrement hit 0; leaking memory.

refcount_t: underflow; use-after-free.

And will then have a trace like:

Call Trace:

<TASK>

? show_regs+0x64/0x70

? __warn+0x83/0x120

? refcount_warn_saturate+0xb2/0x100

? report_bug+0x158/0x190

? prb_read_valid+0x20/0x30

? handle_bug+0x3e/0x70

? exc_invalid_op+0x1c/0x70

? asm_exc_invalid_op+0x1f/0x30

? refcount_warn_saturate+0xb2/0x100

? refcount_warn_saturate+0xb2/0x100

ax25_release+0x2a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References