Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() always consumes the skb. The error path calls nlmsg_free(rsp) so we can’t jump directly to it. Let’s not unbind, just propagate the error to the user. This is the typical way of handling genlmsg_reply() failures. They shouldn’t happen unless user does something silly like calling the kernel with an already-full rcvbuf. A flaw was found in the Linux kernel. A double-free vulnerability exists within thenetdev_nl_bind_rx_doit() function, which is responsible for binding network device receive operations. This vulnerability arises when genlmsg_reply() consumes the socket buffer (skb), and the error handling path subsequently attempts to free the response (rsp) again, resulting in a double-free. This could allow a local attacker to cause a denial of service (DoS) or potentially execute arbitrary code.
Details
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Debian 13 | Released |
10 kernels
|